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Introduction 


This programming manual provides information for application and system-level software developers. It gives a full description 
of the STM32 Cortex®-M33 processor programming model, instruction set and core peripherals. The applicable products are 
listed in the table below. The Cortex®-M33 processor used in STM32L5 Series, is a high performance 32-bit processor designed 
for the microcontroller and microprocessor market. It offers significant benefits to developers, including: 

* Outstanding processing performance combined with fast interrupt handling. 

* Enhanced system debug with extensive breakpoint and trace capabilities. 

* — Efficient processor core, system and memories. 

* — Instruction set extension for signal processing applications. 

*  Ultra-low power consumption with integrated sleep modes. 

* Platform robustness with integrated memory protection unit. 

* Extended security features with Security Extension for Armv8-M. 


Table 1. Applicable products 


Microcontrollers STM32L5 Series 


- Rev 1 - February 2020 www.st.com 


r information contact your local STMicroelectronics sales office. 
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1 About this document 


This document provides information required for application and system-level software development. It does not 
provide information on debug components, features, or operation. 


This document applies to the STM32 MCUs that embed an Arm® Cortex®-M33 processor. 


Note: Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere. 


arm 


This material is for microcontroller software and hardware engineers, including those who have no experience 
with Arm cores. 


1.1 Typographic conventions 


The typographical conventions used in this document are: 


italic Highlights important notes, introduces special terminology, denotes internal cross-references, 
and citations. 


bold Highlights interface elements, such as menu names. Denotes signal names. Also used for 
terms in descriptive lists, where appropriate. 


monospace Denotes text that you can enter at the keyboard, such as commands, file and program names, 
and source code. 


space Denotes a permitted abbreviation for a command or option. You can enter the underlined text 
instead of the full command or option name. 


monospace italic Denotes arguments to monospace text where the argument is to be replaced by a specific 
value. 

monospace bold Denotes language keywords when used outside example code. 

<and> Encloses replaceable terms for assembler syntax where they appear in code or code 


fragments. For example: 


LDRSB<cond> <Rt>, [<Rn>, #<offset>] 
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1.2 List of abbreviations for registers 


The following abbreviations are used in register descriptions: 


read/write (rw) Software can read and write to these bits. 
read-only (r) Software can only read these bits. 
write-only (w) Software can only write to this bit. 


Reading the bit returns the reset value. 
read/clear (rc_w1) Software can read as well as clear this bit by writing 1. 
Writing ‘0’ has no effect on the bit value. 
read/clear (rc_w0) Software can read as well as clear this bit by writing 0. 
Writing ‘1’ has no effect on the bit value. 
toggle (t) Software can only toggle this bit by writing ‘1’. Writing ‘0’ has no effect. 


Reserved (Res.) Reserved bit, must be kept at reset value. 


1.3 About the Cortex®-M33 processor and core peripherals 


The Cortex®-M33 processor is a high-performance 32-bit processor that is designed for the microcontroller 
market. The processor offers outstanding performance, fast interrupt handling, and enhanced system debug with 
extensive breakpoint and trace capabilities. 


Other significant benefits to developers include: 

° Efficient processor core, system, and memories. 

° Instruction set extension for signal processing applications. 

° Ultra-low power consumption with integrated sleep modes. 

° Platform robustness with integrated memory protection unit (MPU). 
° Extended security features with security extension for Armv8-M. 


The Cortex®-M33 processor is built on a high-performance processor core, with a 3-stage pipeline Harvard 
architecture, making it ideal for demanding embedded applications. The in-order processor delivers exceptional 
power efficiency through an efficient instruction set and extensively optimized design. 

The Cortex®-M33 processor provides high-end processing hardware including: 

° IEEE754-compliant single-precision floating-point computation. 

° Single Instruction Multiple Data (SIMD) multiplication and multiply-with-accumulate capabilities. 

° Saturating arithmetic and dedicated hardware division. 
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Figure 1. STM32 Cortex®-M33 processor implementation without the security extension 
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Figure 2. STM32 Cortex®-M33 processor implementation with the security extension 
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To facilitate the design of cost-sensitive devices, the STM32 Cortex®-M33 processor implements tightly-coupled 
system components that reduce processor area while significantly improving interrupt handling and system debug 
capabilities. The STM32 Cortex®-M33 processor implements the T32 instruction set based on STM32 Cortex®- 
M33-2 technology, ensuring high code density and reduced program memory requirements. The STM32 Cortex®- 
M33 processor instruction set provides the exceptional performance that is expected of a modern 32-bit 
architecture, with better code density than most other architectures. 

The STM32 Cortex®-M33 processor closely integrates a configurable Nested Vectored Interrupt Controller (NVIC) 
to deliver industry-leading interrupt performance. The NVIC includes a non-maskable interrupt, and provides up to 
256 interrupt priority levels for other interrupts. The tight integration of the processor core and NVIC provides fast 
execution of Interrupt Service Routines (ISRs), which dramatically reduces interrupt latency. This reduced latency 
is achieved through: 

. The hardware stacking of registers. 

. The ability to suspend load multiple and store multiple operations. 

° Parallel instruction-side and data-side paths. 

. Tail-chaining. 

° Late-arriving interrupts. 

Interrupt handlers do not require wrapping in assembler code, removing any code overhead from the ISRs. The 
tail-chain optimization also significantly reduces the overhead when switching from one ISR to another. 


To optimize low-power designs, the NVIC supports different sleep modes, including a deep sleep function that 
enables the entire device to be rapidly powered down while still retaining program state. 


To increase instruction throughput, the STM32 Cortex®-M33 processor can execute certain pairs of 16-bit 
instructions simultaneously. This is called dual issue. 
1.3.1 System-level interface 


The Cortex®-M33 processor provides multiple interfaces using Arm AMBA® technology to provide high speed, low 
latency memory accesses. 
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1.3.2 Security Extension 


The Armv8-M Security Extension adds security through code and data protection features. 


A processor with the Security Extension supports both Non-secure and Secure states, which are orthogonal to the 
traditional thread and handler modes. The four modes of operation are: 


. Non-secure Thread mode. 
. Non-secure Handler mode. 
° Secure Thread mode. 
° Secure Handler mode. 


When the Security Extension is implemented, the following happens: 
° The processor resets into Secure state. 


° Some registers are banked between Security states. There are two separate instances of the same register, 
one in Secure state and one in Non-secure state. 


. The architecture allows the Secure state to access the Non-secure versions of banked registers. 
. Interrupts can be configured to target one of the two Security states. 

. Some faults are banked between Security states or are configurable. 

. Secure memory can only be accessed from Secure state. 


1.3.3 Integrated configurable debug 


The Cortex®-M33 processor implements a complete hardware debug solution. This provides high system visibility 
of the processor and memory through either a traditional JTAG port or a 2-pin Serial Wire Debug (SWD) port that 
is ideal for microcontrollers and other small package devices. The MCU vendor determines the debug feature 
configuration, therefore debug features can differ across different devices and families. 


The processor provides instruction and data trace and profiling support. To enable simple and cost-effective 
profiling of the resulting system events, a Serial Wire Viewer (SWV) can export a stream of software-generated 
messages, data trace, and profiling information through a single pin. 


The Breakpoint Unit (BPU) supports eight hardware breakpoint comparators and the Data Watchpoint and Trace 
(DWT) eight watchpoint comparators, which debuggers can use. 


1.3.4 Cortex®-M33 processor features and benefits summary 


The Cortex®-M33 processor benefits include tight integration of system peripherals that reduces area and 
development costs, T32 instruction set that combines high code density with 32-bit performance, and IEEE754- 
compliant single-precision Floating-Point Unit (FPU). 

Other processor features and benefits are: 

° Power control optimization of system components. 

° Integrated sleep modes for low power consumption. 

. Armv8-M Security Extension. 

° Fast code execution permits slower processor clock or increases sleep mode time. 

. Hardware integer division and fast multiply accumulate for digital signal processing. 

. Saturating arithmetic for signal processing. 

. Deterministic, high-performance interrupt handling for time-critical applications. 

° MPU and SAU for safety-critical applications. 

° Extensive debug and trace capabilities. 
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1.3.5 Cortex®-M33 processor core peripherals 


The Cortex®-M33 processor has the following core peripherals: 


Nested Vectored Interrupt The NVIC is an embedded interrupt controller that supports low-latency interrupt processing. 


Controller 

System Control Space The SCS is the programmer's model interface to the processor. It provides system 
implementation information and system control. 

System timer The system timer, SysTick, is a 24 bit count-down timer. Use this as a Real Time Operating 


System (RTOS) tick timer or as a simple counter. In an implementation with the Security 
Extension, there are two SysTicks, one Secure and one Non-secure. 


Security Attribution Unit | The SAU improves system security by defining security attributes for different regions. It 
provides eight different regions and a default background region. 


Memory Protection Unit The MPU improves system reliability by defining the memory attributes for different memory 
regions. It provides up to 8 different regions, and an optional predefined background region. 
There can be two MPUs, one Secure (8 regions) and one Non-secure (8 regions). Each MPU 
can define memory attributes independently. 


Floating-point Unit The Floating-point Unit (FPU) provides IEEE754-compliant operations on 32-bit single- 
precision floating-point values. 
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2.4.1 


Thread mode 


The Cortex®-M33 processor 


This chapter provides the reference material for the Cortex®-M33 processor description in a User Guide. 
It contains the following sections: 


Programmer's model 


The programmer's model describes the modes, privilege levels, Security states, stacks and core registers 
available for software execution. 


Processor modes and privilege levels for software execution 


The processor modes are: 


Intended for applications. 


The processor enters Thread mode out of reset and returns to Thread mode on completion of 
an exception handler. 


Handler mode Intended for OS execution. 


Unprivileged 


Privileged 
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All exceptions cause entry into Handler mode. 


Privilege levels 


There are two levels of privilege: 
Software has limited access to system resources. 


Software has full access to system resources, subject to security restrictions. 


In Thread mode, the CONTROL register controls whether software execution is privileged or unprivileged. In 
Handler mode, software execution is always privileged. 


Only privileged software can write to the CONTROL register to change the privilege level for software execution in 
Thread mode. Unprivileged software can use the SVC instruction to make a Supervisor Call to transfer control to 
privileged software. 


Security states 


There are two Security states, Secure and Non-secure. 


Security states are orthogonal to mode and privilege. Therefore each Security state supports execution in both 
modes and both levels of privilege. 


Core registers 

The Cortex®-M33 core registers comprise the general-purpose registers, stack pointer, link register, Program 
Counter, and special registers. 

The following figures and tables illustrate the core registers of the Cortex®-M33 processor: 


¢ Without the Security Extension. 
¢ With the Security Extension. 
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Figure 3. Core registers without the Security Extension 
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Table 2. Core register set summary without the Security Extension 


en el eto ere 
rela wal (=x [=3 


RO-R12 Either UNKNOWN Section 2.1.3.1 General-purpose registers 
MSP RW Either -(3) 
Section 2.1.3.2 Stack Pointer 
PSP RW Either UNKNOWN 
LR RW Either OxFFFFFFFF | Section 2.1.3.4 Link Register 
PC RW Either -(3) Section 2.1.3.5 Program Counter 


aro aelides Section 2.1.3.6 Combined Program Status 


APSR, IPSR, and RW Either -fn) Recisier 
EPSR) g 
APSR RW Either UNKNOWN Section 2.1.3.6.1 Application Program Status 
Register 
IPSR RO Privileged 00000000 Section 2.1.3.6.2 Interrupt Program Status 
Register 
EPSR RO Privileged (4) Section 2.1.3.6.3 Execution Program Status 
Register. 
PRIMASK RW Privileged 00000000 Section 2.1.3.7.1 Priority Mask Register 
FAULTMASK RW Privileged 00000000 Section 2.1.3.7.2 Fault Mask Register 
BASEPRI RW Privileged 00000000 Section 2.1.3.7.3 Base Priority Mask Register 
CONTROL RW Privileged 00000000 Section 2.1.3.8 CONTROL register 
PSPLIM RW Privileged 
00000000 Section 2.1.3.3 Stack limit registers 
MSPLIM RW Privileged 
1. Describes access type during program execution in Thread mode and Handler mode. Debug access can differ. 
2. An entry of Either means privileged and unprivileged software can access the register. 
3. Soft reset to the value retrieved by the reset handler 
4. Bit[24] is the T-bit and is loaded from bit[0] of the reset vector. All other bits are reset to 0. 
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Figure 4. Core registers with the Security Extension 
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Table 3. Core register set summary with the Security Extension 


se ae een ee 
rela (=xe[=3 


RO-R12 Either 

MSP_S Either 
RW 

MSP_NS Either 

PSP_S Either 
RW 

PSP_NS Either 

LR RW Either 

PC RW Either 

xPSR (includes APSR, 

IPSR, and EPSR) ay Eire? 

APSR RW Either 

IPSR RO Privileged 

EPSR RO Privileged 

PRIMASK_S Privileged 
RW 

PRIMASK_NS Privileged 

FAULTMASK_S Privileged 
RW 

FAULTMASK_NS Privileged 

BASEPRI_S Privileged 
RW 

BASEPRI_NS Privileged 


-Rev1 


UNKNOWN 


(3) 


UNKNOWN 


UNKNOWN 


(3) 


(4) 


UNKNOWN 


0x00000000 


(4) 


0x00000000 
0x00000000 
0x00000000 
0x00000000 
0x00000000 
0x00000000 


Section 2.1.3.1 General-purpose registers. 


Section 2.1.3.2 Stack Pointer 


Section 2.1.3.4 Link Register 


Section 2.1.3.5 Program Counter 


Section 2.1.3.6 Combined Program Status 
Register 


Section 2.1.3.6.1 Application Program Status 
Register. 


Section 2.1.3.6.2 Interrupt Program Status 
Register 


Section 2.1.3.6.3 Execution Program Status 
Register 
Section 2.1.3.7.1 Priority Mask Register 


Section 2.1.3.7.2 Fault Mask Register 


Section 2.1.3.7.3 Base Priority Mask Register 
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CONTROL_S Privileged 0x00000000 
Section 2.1.3.8 CONTROL register 
CONTROL_NS Privileged 0x00000000 
MSPLIM_S Privileged 0x00000000 
RW 
MSPLIM_NS Privileged 0x00000000 
Section 2.1.3.3 Stack limit registers 
PSPLIM_S Privileged 0x00000000 
RW 
PSPLIM_NS Privileged 0x00000000 
1. Describes access type during program execution in Thread mode and Handler mode. Debug access can differ. 
2. An entry of Either means privileged and unprivileged software can access the register. 
3. Soft reset to the value retrieved by the reset handler. 
4. Bit[24] is the T-bit and is loaded from bit[O] of the reset vector. All other bits are reset to 0. 


2.1.3.1 General-purpose registers 


RO-R12 are 32-bit general-purpose registers for data operations. 


24.3:2 Stack Pointer 


The stack pointer (SP) is register R13. 

The processor uses a full descending stack, meaning the Stack Pointer holds the address of the last stacked item 
in memory. When the processor pushes a new item onto the stack, it decrements the Stack Pointer and then 
writes the item to the new memory location. 


When Security state is implemented, software must initialize MSP_NS. 


Table 4. Stack pointer register without the Security Extension 


Main MSP 
Process PSP 


In Thread mode, the CONTROL.SPSEL bit indicates the stack pointer to use. 
0 Main stack pointer (MSP). This is the reset value. 


1 Process stack pointer (PSP) 


Table 5. Stack pointer register with the Security Extension 


Main MSP_S 
Secure 

Process PSP_S 

Main MSP_NS 
Non-secure 

Process PSP_NS 
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In Non-secure Thread mode, the CONTROL_NS.SPSEL bit indicates the stack pointer to use: 
0 Main stack pointer (MSP_NS). This is the reset value. 


1 Process stack pointer (PSP_NS). 


In Non-secure Handler mode, the MSP_NS is always used. 
In Secure Thread mode, the CONTROL_S.SPSEL bit indicates the stack pointer to use: 


0 Main stack pointer (MSP_S). This is the reset value. 


1 Process stack pointer (PSP_S). 
In Secure Handler mode, the MSP_S is always used. 
The current Security state of the processor determines whether the Secure or Non-secure stacks are used. 


To ensure that stacks do not overrun, the processor has stack limit check registers that can be programmed to 
define the bounds for each of the implemented stacks. 


2.1.3.3 Stack limit registers 


The stack limit registers define the lower limit for the corresponding stack. The processor raises an exception on 
most instructions that attempt to update the stack pointer below its defined limit. 


The Cortex®-M33 processor has two stack limit registers, as the following table shows. 


If the Security Extension is not implemented, the Cortex®-M33 processor has two stack limit registers, as the 
following table shows. 


Table 6. Stack limit registers without the Security Extension 


Main MSPLIM 
Process PSPLIM 


The Cortex®-M33 processor has four stack limit registers, as the following table shows. 


Table 7. Stack limit registers with the Security Extension 


Security state | Stack Site Mime [Clie 


Main MSPLIM_S 
Secure 
Process PSPLIM_S 
Main MSPLIM_NS 
Non-secure 
Process PSPLIM_NS 
Note: The four stack limit registers are banked between Security states. 


See Table 2. Core register set summary without the Security Extension table for the stack limit registers attributes. 
The bit assignments for the MSPLIM and PSPLIM registers are as follows: 
31 : 13.2 0: 


LIMIT RESO 
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2.1.3.4 


2.1.3.5 


2.1.3.6 


2.1.3.6.1 
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Table 8. MSPLIM and PSPLIM register bit assignments 


Peis ame rurcton 


[34:3] LIMIT Main stack limit or process stack limit address for the selected Security state. Limit address for the selected 
i stack pointer. 


[2:0] | - Reserved, res0. 


Link Register 

The Link Register (LR) is register R14. It stores the return information for subroutines, function calls, and 
exceptions. On reset, the processor sets the LR value to OXxFFFFFFFF. 

Program Counter 

The Program Counter (PC) is register R15. It contains the current program address. 

On reset, the processor loads the PC with the value of the reset vector defined in the vector table. 
Combined Program Status Register 


The Combined Program Status Register (xPSR) consists of the Application Program Status Register (APSR), 
Interrupt Program Status Register (IPSR), and Execution Program Status Register (EPSR). 
These registers are mutually exclusive bit fields in the 32-bit PSR. The bit assignments are as follows: 

31 30 29 28 27 26 25 24 23 20.19 16.15 109 8 0 

















APSR Reserved GE[3:0] Reserved 


IPSR Reserved ISR_NUMBER 








EPSR 





Reserved Reserved IT/ICI Reserved 








Access these registers individually or as a combination of any two or all three registers, using the register name 
as an argument to the MSR or MRS instructions. For example: 


. Read all the registers using PSR with the MRS instruction. 
° Write to the APSR N, Z, C, V, and Q bits using APSR_nzcvq with the MSR instruction. 


The PSR combinations and attributes are: 


Table 9. xPSR register combinations 


xPSR RW(1)(2) APSR, EPSR, and IPSR 
IEPSR RO?) EPSR and IPSR 
IAPSR RW) APSR and IPSR 
EAPSR RW?) APSR and EPSR 


1. The processor ignores writes to the IPSR bits. 
2. Reads of the EPSR bits return zero, and the processor ignores writes to these bits. 


See the MRS and MSR instruction descriptions for more information about how to access the Program Status 
Registers. 

Application Program Status Register 

The APSR contains the current state of the condition flags from previous instruction executions. 


See Table 2. Core register set summary without the Security Extension for the APSR attributes. 
The APSR bit assignments are as follows: 
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Table 10. APSR bit assignments 


SL 


[31] N Negative flag. 

[30] Z Zero flag. 

[29] Cc Carry or borrow flag. 

[28] V Overflow flag. 

[27] Q DSP overflow and saturation flag. 
[26:20] - Reserved. 


[19:16] GE[3:0] Greater than or Equal flags. See Section 3.4.11 SEL for more information. 
[15:0] - Reserved. 


2.1.3.6.2 Interrupt Program Status Register 


The IPSR contains the exception number of the current ISR. 
The bit assignments are: 


Table 11. IPSR bit assignments 


LO 


[31:9] - Reserved. 
This is the number of the current exception: 
0 = Thread mode. 
1 = Reset. 
2=NMI. 
3 = HardFault. 
4 = MemManage. 
5 = BusFault. 
6 = UsageFault 
7 = SecureFault 
8-10 = Reserved. 
[8:0] Exception number 7-10 = Reserved. 
11 = SVCall. 
12 = DebugMonitor. 
13 = Reserved. 
14 = PendSVv. 
15 =SysTick 
16 = IRQO. 


495 = IRQ479. 


The active bits in the Exception number field depend on the number of interrupts implemented. 
0-47 interrupts = [5:0]. 
48-111 interrupts = [6:0]. 
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112-239 interrupts = [7:0]. 
240-479 interrupts = [8:0]. 
2.1.3.6.3 Execution Program Status Register 


The EPSR contains the Thumb state bit and the execution state bits for the /f-Then (IT) instruction, and 
Interruptible-Continuable Instruction (\Cl) field for an interrupted load multiple or store multiple instruction. 
See the Table 2. Core register set summary without the Security Extension for the EPSR attributes. 

The following table shows the EPSR bit assignments. 


Table 12. EPSR bit assignments 


[31:27] - Reserved 

[26:25], [15:10] | ICI Interruptible-continuable instruction bits, see Section 2.1.3.6.4 Interruptible-continuable instructions 
[26:25], [15:10] | IT Indicates the execution state bits of the IT instruction, see Section 3.9.5 IT 

[24] T Thumb state bit, see Section 2.1.3.6.6 Thumb state 

[23:16] - Reserved 

[9:0] - Reserved 


Attempts to read the EPSR directly through application software using the MSR instruction always return zero. 
Attempts to write the EPSR using the MSR instruction in application software are ignored. 


2.1.3.6.4 Interruptible-continuable instructions 


When an interrupt occurs during the execution of an LDM, STM, PUSH, POP, VLDM, VSTM, VPUSH, or VPOP 
instruction, the processor can stop the load multiple or store multiple instruction operation temporarily, storing the 
next register operand in the multiple operation to be transferred into EPSR[15:12]. 


After servicing the interrupt, the processor resumes execution of the load or store multiple, starting at the register 
stored in EPSR[15:12]. 


When the EPSR holds ICI execution state, bits[26:25, 11:10] are zero. 
Note: There might be cases where the processor cannot pause and resume load or store multiple instructions in this 
way. When this happens, the processor restarts the instruction from the beginning on return from the interrupt. 


As a result, your software should never use load or store multiple instructions to memory that is not robust to 
repeated accesses. 


2.1.3.6.5 If-Then block 


The If-Then block contains up to four instructions following an IT instruction. Each instruction in the block is 
conditional. The conditions for the instructions are either all the same, or some can be the inverse of others. 


Note: Interruptible-continuable operation is not supported when the load multiple or store multiple instructions are 
located inside an If-Then block. In these cases, the processor can take an interrupt part-way through the load or 
store multiple instruction, restarting it from the beginning on return from the interrupt. 


2.1.3.6.6 Thumb state 


The Cortex®-M33 processor only supports execution of instructions in Thumb state. 
The following can modify the T bit in the EPSR: 

° Instructions BLX, BX, LDR pc, [], and POP{PC}. 

. Restoration from the stacked xPSR value on an exception return. 

. Bit[0] of the vector value on an exception entry or reset. 


Attempting to execute instructions when the T bit is 0 results in a fault or lockup. See Section 2.6.4 Lockup for 
more information. 
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2.1.3.7 Exception mask registers 
The exception mask registers disable the handling of exceptions by the processor. For example, you might want 
to disable exceptions when running timing critical tasks. 


To access the exception mask registers use the MSR and MRs instructions, or the CPS instruction to change the 
value of PRIMASK.PM or FAULTMASK.FM. 


2.1.3.7.1 Priority Mask Register 


The PRIMASK register is intended to disable interrupts by preventing activation of all exceptions with configurable 
priority in the current Security state. 

See Table 2. Core register set summary without the Security Extension table for the PRIMASK attributes. 

The bit assignments for the PRIMASK register are as follows: 


31 10 
ee ee 
PM 


Table 13. PRIMASK register bit assignments 


Pes ame con 


[31:1] | - Reserved, res0. 


Setting this bit to one boosts the current execution priority to 0, masking all exceptions with a programmable 
priority. 


Setting PRIMASK_S to one boosts the current execution priority to 0. If AIRCR.PRIS is: 
[0] PM 0 Setting PRIMASK_NS to one boosts the current execution priority to 0. 


1 Setting PRIMASK_NS to one boosts the current execution priority to 80. 


When the current execution priority is boosted to a particular value, all exceptions with a lower or equal priority 
are masked. 


2.1.3.7.2 Fault Mask Register 
The FAULTMASK register prevents activation of all exceptions with configurable priority and also some 
exceptions with fixed priority depending on the value of AARCR.BFHFNMINS and AIRCR.PRIS. 


See Table 2. Core register set summary without the Security Extension table for the FAULTMASK register 
attributes. 


The bit assignments for the FAULTMASK register are as follows: 


31 10 
em 
FM 
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Table 14. FAULTMASK register bit assignments 


Ps Dame | non 


[31:1] | - Reserved, resO 


When TrustZone is disabled, setting this bit to one boosts the current execution priority to -1, masking all 
exceptions except NMI. 


When TrustZone is enabled, setting this bit to one boosts the current execution priority to -1, masking all 
exceptions with a lower priority. If 


AIRCR.BFHFNMINS is: 


Setting FAULTMASK_S to one boosts the current execution priority to -1. 
If AIRCR.PRIS is: 


[0] FM 0 
0: Setting FAULTMASK_NS to one boosts the current execution priority to 0 
1: Setting FAULTMASK_NS to one boosts the current execution priority to 80 
, Setting FAULTMASK_S to one boosts the current execution priority to -3. 


Setting FAULTMASK_NS to one boosts the current execution priority to -1. 


When the current execution priority is boosted to a particular value, all exceptions with a lower or equal 
priority are masked. 


2.1.3.7.3 Base Priority Mask Register 


Use the BASEPRI register to change the priority level that is required for exception preemption. 
See Table 2. Core register set summary without the Security Extension table for the BASEPRI register attributes. 
The bit assignments for the BASEPRI register are as follows: 


31 8 7 0 


Table 15. BASEPRI register bit assignments 


[31:8] | - Reserved, resO 
Software can set BASEPRI to a priority number between 1 and the maximum supported priority number. 


Software can set BASEPRI_S to a priority number between 1 and the maximum supported priority 
number. If AIRCR.PRIS is: 


Software can set BASEPRI_NS to a priority number between 1 and the 
maximum supported priority number. 


[7:0] BASEPRI*) 
Software can set BASEPRI_NS to a priority number between 1 and the 
maximum supported priority number. The value in BASEPRI_NS is then 
1 mapped to the bottom half of the priority range, so that the current execution 
priority is boosted to the mapped-to value in the bottom half of the priority 
range. 


When the current execution priority is boosted to a particular value, all exceptions with a lower priority 
are masked. Writing 0 to BASEPRI disables base priority boosting. 


1. This field is similar to the priority fields in the interrupt priority registers. If the device implements only bits[7:M] of this field, 
bits[M-1:0] read as zero and ignore writes. See Section 4.2.7 Interrupt Priority Registers for more information. Remember 
that higher priority field values correspond to lower exception priorities. 
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2.1.3.8 CONTROL register 


The CONTROL register controls the stack that is used, the privilege level for software execution when the core is 
in Thread mode and indicates whether the FPU state is active. 

See Table 2. Core register set summary without the Security Extension table for the CONTROL register attributes. 
This register is banked between Security states on a bit by bit basis. 

The bit assignments for the CONTROL register are as follows: 


31 43210 


RESO 
srPa—! L nPRIV 
FPCA SPSEL 





Table 16. CONTROL register bit assignments 


Peis Pam rercton 


[31:4] | - Reserved, resO 

Indicates that the floating-point registers contain active state that belongs to the Secure state: 

0 The floating-point registers do not contain state that belongs to the Secure state. 
[3] SFPA 

1 The floating-point registers contain state that belongs to the Secure state. 

This bit is not banked between Security states and RAZ/WI from Non-secure state. 


Indicates whether floating-point context is active: 


0 No floating-point context active. 


[2] FPCA 
1 Floating-point context active. 


This bit is used to determine whether to preserve floating-point state when processing an exception. 


This bit is not banked between Security states. 


Defines the currently active stack pointer: 
0 MSP is the current stack pointer. 


[1] SPSEL |, PSP is the current stack pointer. 


In Handler mode, this bit reads as zero and ignores writes. The Cortex®-M33 core updates this bit 
automatically on exception return. 


This bit is banked between Security states. 
Defines the Thread mode privilege level: 
0 Privileged. 
[0] nPRIV 
1 Unprivileged. 


This bit is banked between Security states. 
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Handler mode always uses the MSP, so the processor ignores explicit writes to the active stack pointer bit of the 
CONTROL register when in Handler mode. The exception entry and return mechanisms automatically update the 
CONTROL register based on the EXC_RETURN value. 


In an OS environment, Arm® recommends that threads running in Thread mode use the process stack and the 
kernel and exception handlers use the main stack. 


By default, Thread mode uses the MSP. To switch the stack pointer that is used in Thread mode to the PSP, 
either: 


° Use the MSR instruction to set the CONTROL.SPSEL bit, the current active stack pointer bit, to 1. 
° Perform an exception return to Thread mode with the appropriate EXC_RETURN value. 


Note: When changing the stack pointer, software must use an ISB instruction immediately after the MSR instruction. 
This ensures that instructions after the ISB instruction execute using the new stack pointer. 


2.1.4 Exceptions and interrupts 


The Cortex®-M33 processor implements all the logic required to handle and prioritize interrupts and other 
exceptions. Software can control this prioritization using the NVIC registers. All exceptions are vectored and 
except for reset, handled in Handler mode. Exceptions can target either Security state. 


The NVIC registers control interrupt handling. 
Related reference 
Section 4.2 Nested Vectored Interrupt Controller 


2.1.5 Data types and data memory accesses 


The Cortex®-M33 processor manages all data memory accesses as little-endian. 
The processor supports the following data types: 

° 32-bit words. 

° 16-bit halfwords. 

° 8-bit bytes. 

° 32-bit single-precision floating-point numbers. 

° 64-bit double-precision floating-point numbers. 


2.1.6 The Cortex Microcontroller Software Interface Standard 
The Cortex Microcontroller Software Interface Standard (CMSIS) simplifies software development by enabling the 
reuse of template code and the combination of CMSIS-compliant software components from various middleware 
vendors. Vendors can expand the CMSIS to include their peripheral definitions and access functions for those 
peripherals. 
For a Cortex®-M33 microcontroller system, the CMSIS defines: 
° A common way to: 
— Access peripheral registers. 
- Define exception vectors. 
° The names of: 
- The registers of the core peripherals. 
- The core exception vectors. 
° A device-independent interface for RTOS kernels, including a debug channel. 


The CMSIS includes address definitions and data structures for the core peripherals in the Cortex®-M33 
processor. 


This document includes the register names defined by the CMSIS, and short descriptions of the CMSIS functions 
that address the processor core and the core peripherals. 


Note: This document uses the register short names that are defined by the CMSIS. In a few cases these short names 
differ from the architectural short names that might be used in other documents. 


2.2 Cortex® M33 configurations 


Table 17 shows the configuration for the STM32L5 Series Cortex® M33. 
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Table 17. STM32L5xx Cortex® M33 configuration 


Features STM32L5xx 


Security extension (TrustZone®) Yes\") 

DSP Yes 

Floating Point Unit Yes, single precision floating point unit 

MPU MPU secure (8 regions), MPU non-secure (8 regions) 
SAU 8 regions 

Interrupt priority levels 8 

Number of IRQ 109 

WIC Not implemented 

CTI Yes 


JTAG and serial-wire debug ports 8 breakpoints and 4 


Belay watchpoints. 
ITM support Data trace (DWT), and instrumentation trace (ITM) 
ETM support Instruction trace interface 


1. The TrustZone® is enabled by setting the TZEN option bit. 


2.3 Memory model 


The Cortex®-M33 processor has a fixed default memory map that provides up to 4GB of addressable memory. 
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2.3.1 Processor memory map 


The Cortex-M33 processor memory map. 


Figure 5. Cortex-M33 processor memory map 























OxFFFFFFFF 
Vendor-specific 541MB 
memory 
0xE0100000 
Private peripheralbus,, ),, OxEOOFFFFF 
0xE0000000 
OxDFFFFFFF 
External device 1.0GB 
0xA0000000 
Ox9FFFFFFF 
ExternalRAM 1.0GB 
0x60000000 
OxSFFFFFFF 
Peripheral 0.5GB 
0x40000000 
Ox3FFFFFFF 
SRAM 0.5GB 
0x20000000 
Ox1FFFFFFF 
Code 0.5GB 
0x00000000 











The processor reserves regions of the Private peripheral bus (PPB) address range for core peripheral registers. 


PM0264 - Rev 1 page 22/245 





PM0264 


Memory model 


1 





2.3.2 Memory regions, types, and attributes 


The memory map and the programming of the Secure and Non-secure MPUs splits memory into regions. If your 
implementation has an MPU or has the Security Extension MPUs, programming the relevant MPUs splits memory 
into regions. 

The memory types are: 


Normal The processor can reorder transactions for efficiency, or perform Speculative reads. 


Device The processor preserves transaction order relative to other transactions to Device memory. 


The additional memory attributes include: 


Shareable For a shareable memory region, the memory system might provide data synchronization 
between bus masters in a system with multiple bus masters, for example, a processor with a 
DMA controller. 


If multiple bus masters can access a Non-shareable memory region, software must ensure data 
coherency between the bus masters. 


Device memory is always Shareable. 


<This description is required only if the device is likely to be used in systems where memory is 
shared between multiple processors.> 


Execute Never (XN) Means that the processor prevents instruction accesses. A MemManage fault exception is 
generated on executing an instruction fetched from an XN region of memory. 


2.3.3 Device memory 


Device memory must be used for memory regions that cover peripheral control registers. Some of the 
optimizations that are permitted for Normal memory, such as access merging or repeating, can be unsafe for a 
peripheral register. 


The Device memory type has several attributes: 


GornG Gathering or non-Gathering. Multiple accesses to a device can be merged into a single 
transaction except for operations with memory ordering semantics, for example, memory 
barrier instructions, load acquire/store release. 


RornR Reordering or non-Reordering. 


E or nE Early Write Acknowledgement or no Early Write Acknowledgement. 


For the Cortex-M33 processor, only two combinations of these attributes are valid: 
° Device-nGnRnE. 
° Device-nGnRE. 


Note: . Device-nGnRnE is equivalent to Armv7-M Strongly Ordered memory type 
. Device-nGnRE is equivalent to Armv7-M Device memory. 
° Device-nGRE and Device-GRE are new to the Armv8-M architecture. 
Typically, peripheral control registers must be either Device-nGnRE or Device-nGnRnE to prevent reordering of 
the transactions in the programming sequences. 


Note: Device memory is shareable, and must not be cached. 


2.3.4 Secure memory system and memory partitioning 
In an implementation with the Security Extension, the Security Attribution Unit (SAU) and Implementation Defined 
Attribution Unit (IDAU) partition the 4GB memory space into Secure and Non-secure memory regions. 


Note: The partitioning of the memory into Secure and Non-secure regions is independent of the Security state that the 
processor executes in. See Section 2.5 Security state switches for more information on Security state. 
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Secure memory Secure addresses are used for memory and peripherals that are only accessible by Secure 

partitioning software or Secure masters. Transactions are deemed to be secure if they are to an address 
that is defined as Secure. Illegitimate accesses that are made by Non-secure software to 
Secure memory are blocked and raise an exception. 


Non-secure Callable (NSC) NSC is a special type of Secure location that is permitted to hold an SG instruction to enable 
software to transition from Non-secure to Secure state. The inclusion of NSC memory locations 
removes the need for Secure software creators to allow for the accidental inclusion of SG 
instructions, or data sharing encoding values, in normal Secure memory by restricting the 
functionality of the SG instruction to NSC memory only. 


Non-secure (NS) Non-secure addresses are used for memory and peripherals accessible by all software running 
on the device. 


Transactions are deemed to be Non-secure if they are to an address that is defined as Non- 
Secure. 


Note: Transactions are deemed to be Non-secure even if secure software performs the 
access. Memory accesses initiated by Secure software to regions marked as 
Non-secure in the SAU IDAU are marked as Non-secure on the AHB bus. 


The MPU is banked between Secure and Non-secure memory. For instructions fetches, addresses that are 
Secure are subject to the Secure MPU settings. Addresses that are Non-secure are subject to the Non-secure 
MPU settings. For data loads and data stores, accesses depend on the Security state of the processor. For 
example, if the processor is in Secure state the access is subject to the Secure MPU settings. If the processor is 
in Non-secure state the access is subject to the Non-secure MPU settings. 


2.3.5 Behavior of memory accesses 


Summary of the behavior of accesses to each region in the memory map. 


Table 18. Memory access behavior 


Executable region for program code. 


0x00000000-0x1FFFFFFF Code Normal Non-shareable | - 
You can also put data here. 
0x20000000-0x3FFFFFFF = SRAM Normal Non-shareable| = .'| Sxeculble regian for data. "yeu can 
also put code here. 

' Device, ; , 
0x40000000-Ox5FFFFFFF Peripheral nGnRE Shareable XN | On-chip device memory. 
0x60000000-0x9FFFFFFF § RAM Normal Non-shareable | - Executable region for data. 

. Device, : 
0xA0000000-0xDFFFFFFF External device nGnRE Shareable XN External device memory. 


This region includes the SCS, NVIC, 
Shareable XN) MPU, SAU, BPU, ITM, and DWT 
registers. 


0xE0000000-0xE003FEFF Private Peripheral Device, 
Bus nGnRnE 
This region is for debug components 

Shareable XN and can include the ETM, CTI, and 
TPIU configuration registers or none. 


Device, 


0xE0040000-0xE0043FFF — Device nGnRnE 


Private Peripheral Device, 


0xE0044000-0xEOOFFFFFF Shareable XN_ This region includes the ROM tables. 


Bus nGnRnE 
Device, a 
0xE0100000-OxFFFFFFFFF Vendor_SYS nGnRE Shareable XN _ Vendor specific. 
Note: For more information on memory types, see Section 2.3.2 Memory regions, types, and attributes. 


The Code, SRAM, and RAM regions can hold programs. 


PM0264 - Rev 1 page 24/245 





PM0264 


Memory model 


‘] 





The MPU can override the default memory access behavior described in this section. 


2.3.5.1 Additional memory access constraints for caches and shared memory 


When a system includes caches or shared memory, some memory regions have additional access constraints, 
and some regions are subdivided. 


This behavior is shown by the following table: 


Table 19. Memory region shareability and cache policies 


Address range Memory type Shareability oF: Tes T= fe) [Cen 


0x00000000-0x1FFFFFFF Code Normal 
0x20000000-0x3FFFFFFF SRAM Normal - WBWA 
0x40000000-0x5FFFFFFF Peripheral Device Shareable - 
0x60000000-0x7FFFFFFF WBWA 
RAM Normal - 
0x80000000-0x9FFFFFFF WT 
0xA0000000-0xDFFFFFFF External device Device Shareable - 
0xE0000000-0xE003FFFF Private Peripheral Bus Device Shareable - 
0xE0040000-0xE0043FFF Device Device Shareable - 
0xE0044000-0xEOOEFFFF Private Peripheral Bus - Shareable Device 
0xF0000000-OxFFFFFFFF Vendor_SYS Device Shareable Device 
Note: For more information on memory types and shareability, see Section 2.3.2 Memory regions, types, and 
attributes. 
2.3.6 Software ordering of memory accesses 
The order of instructions in the program flow does not always guarantee the order of the corresponding memory 
transactions. 


In the Cortex-M33 processor this behavior can occur because of two reasons: 

. Memory or devices in the memory map might have different wait states. 

. Some memory accesses associated with instruction fetches are speculative. 

Section 2.3.3 Device memory describes the cases where the memory system guarantees the order of memory 


accesses. Otherwise, if the order of memory accesses is critical, software must include memory barrier 
instructions to force that ordering. 


The processor provides the following memory barrier instructions: 


DMB The Data Memory Barrier (DMB) instruction ensures that outstanding memory transactions 
complete before subsequent memory transactions. 


DSB The Data Synchronization Barrier (DSB) instruction ensures that outstanding memory 
transactions complete before subsequent instructions execute. 


ISB The /nstruction Synchronization Barrier (ISB) ensures that the effect of any context-changing 
operations is recognizable by subsequent instructions. 


The following are examples of using memory barrier instructions: 
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Exception vector and If the program changes an entry in the vector table, and then enables the corresponding 
vector table programming exception, use a DMB instruction between the operations. This ensures that if the exception is 
taken immediately after being enabled, then the processor uses the new exception vector. 


If the program updates the value of the VTOR, use a DMB instruction to ensure that the new 
vector table is used for subsequent exceptions. 


Self-modifying code If a program contains self-modifying code, use a DSB instruction followed by an ISB instruction 
immediately after the code modification in the program. This ensures subsequent instruction 
execution uses the updated program. 


Memory map switching If the system contains a memory map switching mechanism, use a DSB instruction followed by 
an ISB instruction after switching the memory map. This ensures subsequent instruction 
execution uses the updated memory map. 


MPU programming Use a DSB followed by an ISB instruction or exception return to ensure that the new MPU 
configuration is used by subsequent instructions. 


SAU programming Use a DSB followed by an ISB instruction or exception return to ensure that the SAU 
configuration is used by subsequent instructions. 


2.3.1 Memory endianness 


The processor views memory as a linear collection of bytes numbered in ascending order from zero. For example, 
bytes 0-3 hold the first stored word, and bytes 4-7 hold the second stored word. Little-endian format in Figure 6 
describes how words of data are stored in memory. 


Little-endian format 


In little-endian format, the processor stores the /east significant byte (Isbyte) of a word at the lowest-numbered 
byte, and the most significant byte (msbyte) at the highest-numbered byte. 


Figure 6. Little-endian example 


Memory Register 
7 0 


31 2423 1615 87 0 
B3 B2 B1 BO 





Address A 
At+1 
At2 


At3 





2.3.8 Synchronization primitives 


The instruction set support for the processor includes pairs of synchronization primitives. These provide a non- 
blocking mechanism that a thread or process can use to obtain exclusive access to a memory location. Software 
can use them to implement semaphores or an exclusive read-modify-write memory sequence. 


Instructions in synchronization primitives 


A pair of synchronization primitives contains the following: 


A Load-Exclusive Used to read the value of a memory location, requesting exclusive access to that location. 
instruction 
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A Store-Exclusive Used to attempt to write to the same memory location, returning a status bit to a register. If this 
instruction bit is: 
0 It indicates that the thread or process gained exclusive access to the memory, and the 


write succeeded. 


a It indicates that the thread or process did not gain exclusive access to the memory, and no 
write was performed. 


Load-Exclusive and Store-Exclusive instructions 


The pairs of Load-Exclusive and Store-Exclusive instructions are: 
° The word instructions: 

- .DAEX and STLEX. 

- .DREX and STREX. 
° The halfword instructions: 

- ,DAEXH and STLEXH. 

- .DREXH and STREXH. 























. The byte instructions: 
- »DAEXB and STLEXB. 
- :DREXB and STREXB. 























Performing an exclusive read-modify-write 


Software must use a Load-Exclusive instruction with the corresponding Store-Exclusive instruction. 
To perform an exclusive read-modify-write of a memory location, the software must: 

1. Use aLoad-Exclusive instruction to read the value of the location. 

2. Modify the value, as required. 

3. Use a Store-Exclusive instruction to attempt to write the new value back to the memory location. 
4 Test the returned status bit. If this bit is: 


0 The read-modify-write completed successfully. 


1 No write was performed. This indicates that the value returned at step 1 might be out of date. 
The software must retry the entire read-modify-write sequence. 


Implementing a semaphore 


The software can use the synchronization primitives to implement a semaphore as follows: 


1. Use aLoad-Exclusive instruction to read from the semaphore address to check whether the semaphore is 
free. 


2. — If the semaphore is free, use a Store-Exclusive to write the claim value to the semaphore address. 


3. If the returned status bit from step 2 indicates that the Store-Exclusive succeeded, then the software has 
claimed the semaphore. However, if the Store-Exclusive failed, another process might have claimed the 
semaphore after the software performed step 1. 


Exclusive tags 


The processor includes an exclusive access monitor, that tags the fact that the processor has executed a Load- 
Exclusive instruction. If the processor is part of a multiprocessor system with a global monitor, and the address is 
in a shared region of memory, then the system also globally tags the memory locations that are addressed by 
exclusive accesses by each processor. 

The processor clears its exclusive access tag if: 


° It executes a CLREX instruction. 
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° It executes a STREX or STLEX instruction, regardless of whether the write succeeds. 


° An exception occurs. This means that the processor can resolve semaphore conflicts between different 
threads. 


In a multiprocessor implementation: 





. Executing a CLREX instruction clears only the local exclusive access tag for the processor. 





° Executing a STREX or STLEX instruction, or an exception, clears the local exclusive access tags for the 
processor. 

° Executing a STREX or STLEX instruction to a Shareable memory region can also clear the global exclusive 
access tags for the processor in the system. 




















For more information about the synchronization primitive instructions, see Section 3.12.10 LDREX and STREX 
and Section 3.12.12 CLREX. 


A global exclusive access can be performed: 

. In a Shared region if the MPU is implemented. 

. By setting ACTLR.EXTEXCLALL. In this case, exclusive information is always sent externally. 

In any other case, exclusive information is not sent on the AHB bus, HEXCL is 0, and only the local monitor is 
used. 


If HEXCL is sent externally and there is no exclusive monitor for the corresponding memory region, then STREX 
and STLEX fails. 








2.3.9 Programming hints for the synchronization primitives 


ISO/IEC C cannot directly generate the exclusive access instructions. CMSIS provides intrinsic functions for 
generation of these instructions. 


Table 20. CMSIS functions for exclusive access instructions 


cone CMSIS function 

























































































uintl6 t _ LDAEX (volatile uintl6 t * ptr) 

i\DAEXB uint8 t | LDAEXB (volatile uint8 t * ptr) 

i\DAEXH uintl6 t _ LDAEXH (volatile uintl6 t * ptr) 

i\DREX uint32 t — LDREXW (uint32_ t *addr) 

,DREXB uint8_t | LDREXB (uint8 t *addr) 

:DREXH uintl6 t _ LDREXH (uintl6 t *addr) 

STLEX uintl6é t — STLEX (uintl6 t value, volatile uintl6 t * ptr) 
STLEXB uint8 t | STLEXB (uint8 t value, volatile uint8 t * ptr) 
STLEXH uintl6 t — STLEXH (uintl6 t value, volatile uintl6 t * ptr) 
STREX uint32 t  STREXW (uint32_t value, uint32 t *addr) 

STREXB uint8 t _STREXB (uint8 t value, uint8 t *addr) 

STREXH uintl6 t — STREXH (uintl6 t value, uintl6 t *addr) 

CLREX void _CLREX (void) 
For example: 


uintl6é_t value; 
UantelG Ee *address) — 0x2 00010027 
value = __LDREXH (address); // load 16-bit value from memory address 0x20001002 
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2.4 Exception model 


This section contains information about different parts of the exception model such as exception types, exception 
priorities and exception states. 


2.4.1 Exception states 


Each exception is in one of the following states. 
Inactive The exception is not active and not pending. 


Pending The exception is waiting to be serviced by the processor. 


An interrupt request from a peripheral or from software can change the state of the 
corresponding interrupt to pending. 


Active An exception is being serviced by the processor but has not completed. 


Note: An exception handler can interrupt the execution of another exception handler. 
In this case, both exceptions are in the active state. 


Active and pending The exception is being serviced by the processor and there is a pending exception from the 
same source. 


2.4.2 Exception types 


This section describes the exception types for a processor with and without the Security Extension. 


Reset The exception model treats reset as a special form of exception. When reset is asserted, the 
operation of the processor stops, potentially at any point in an instruction. When either power- 
on or warm reset is deasserted, execution restarts from the address provided by the reset entry 
in the vector table. Execution restarts as privileged execution in Secure state in Thread mode. 


This exception is not banked between Security states. 


NMI A Non-Maskable Interrupt (NMI) can be signaled by a peripheral or triggered by software. It is 
permanently enabled and has a fixed priority of -2. NMI can only be preempted by reset and, 
when it is Non-secure, by a Secure HardFault. 

If AIRCR.BFHFNMINS=0, then the NMI is Secure. 


If AIRCR.BFHFNMINS=1, then NMI is Non-secure. 


HardFault A HardFault is an exception that occurs because of an error during normal or exception 
processing. HardFaults have a fixed priority of at least -1, meaning they have higher priority 
than any exception with configurable priority. 

This exception is not banked between Security states. 

If AIRCR.BFHFNMINS=0, HardFault handles all faults that are unable to preempt the current 
execution. The HardFault handler is always Secure. 

If AIRCR.BFHFNMINS=1, HardFault handles faults that target Non-secure state that are unable 
to preempt the current execution. 

HardFaults that specifically target the Secure state when AIRCR.BFHFNMINS is set to 1 have 
a priority of -3 to ensure they can preempt any execution. A Secure HardFault at Priority -3 is 
only enabled when AIRCR.BFHFNMINS is set to 1. Secure HardFault handles Secure faults 
that are unable to preempt current execution. 


MemManage A MemManage fault is an exception that occurs because of a memory protection violation, 
compared to the MPU or the fixed memory protection constraints, for both instruction and data 
memory transactions. This fault is always used to abort instruction accesses to Execute Never 
(XN) memory regions. 

This exception is banked between Security states. 
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BusFault 


UsageFault 


SecureFault 


SVCall 


DebugMonitor 


PendSV 


SysTick 


Interrupt (IRQ) 
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A BusFault is an exception that occurs because of a memory-related violation for an instruction 
or data memory transaction. This might be from an error that is detected on a bus in the 
memory system. 


This exception is not banked between Security states. 
If BFHFNMINS=0, BusFaults target the Secure state. 
If BEHFNMINS=1, BusFaults target the Non-secure state. 


A UsageFault is an exception that occurs because of a fault related to instruction execution. 
This includes: 

° An undefined instruction. 

° An illegal unaligned access. 

° Invalid state on instruction execution. 

. An error on exception return. 


The following can cause a UsageFault when the core is configured by software to report them: 
° An unaligned address on word and halfword memory access. 
° Division by zero. 


This exception is banked between Security states. 


This exception is triggered by the various security checks that are performed. It is triggered, for 
example, when jumping from Non-secure code to an address in Secure code that is not marked 
as a valid entry point. Most systems choose to treat a SecureFault as a terminal condition that 
either halts or restarts the system. Any other handling of the SecureFault must be checked 
carefully to make sure that it does not inadvertently introduce a security vulnerability. 


SecureFaults always target the Secure state. 


A Supervisor Call (SVC) is an exception that is triggered by the SVC instruction. In an OS 
environment, applications can use SVC instructions to access OS kernel functions and device 
drivers. 


This exception is banked between Security states. 


A DebugMonitor exception. If Halting debug is disabled and the debug monitor is enabled, a 
debug event causes a DebugMonitor exception when the group priority of the DebugMonitor 
exception is greater than the current execution priority. 


PendSV is an asynchronous request for system-level service. In an OS environment, use 
PendSV for context switching when no other exception is active. 


This exception is banked between Security states. 


A SysTick exception is an exception the system timer generates when it reaches zero. Software 
can also generate a SysTick exception. In an OS environment, the processor can use this 
exception as a system tick. 


This exception is banked between Security states. 


An interrupt, or IRQ, is an exception signaled by a peripheral, or generated by a software 
request. All interrupts are asynchronous to instruction execution. In the system, peripherals use 
interrupts to communicate with the processor. 


This exception is not banked between Security states. Secure code can assign each interrupt 
to Secure or Non-secure state. By default all interrupts are assigned to Secure state. 
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Table 21. Properties of the different exception types with the Security Extension 


=> Cox) o) fea} 





Tallin) f=) am (2121-1 IRnumnber: Exception type Priority AV(<Yos Co) mr Lolo q-t-t-) Activation 
(see notes) 
notes) 
1 - Reset -4, the highest 0x00000004 Asynchronous 
2 -14 NMI -2 0x00000008 Asynchronous 
Secure HardFault when 3 
AIRCR.BFHFNMINS is 1 
3 -13 Secure HardFault when 4 0x0000000C Synchronous 
AIRCR.BFHFNMINS is 0 
HardFault -1 
4 -12 MemManage Configurable | 0x00000010 Synchronous 
5 -11 BusFault Configurable | 0x00000014 Synchronous 
6 -10 UsageFault Configurable | 0x00000018 Synchronous 
7 -9 SecureFault Configurable | 0x0000001C Synchronous 
8-10 - Reserved - - - 
44 -5 SVCall Configurable | 0x0000002C Synchronous 
12 -4 DebugMonitor Configurable | 0x00000030 Synchronous 
13 - Reserved - - - 
14 -2 PendSV Configurable | 0x00000038 Asynchronous 
15 -1 SysTick Configurable | 0x0000003C Asynchronous 
0x00000040 and 
16 and above 0 and above Interrupt (IRQ) Configurable above. Increasing in |= Asynchronous 
steps of 4 
Note: . To simplify the software layer, the CMSIS only uses IRQ numbers. It uses negative values for exceptions 
other than interrupts. The IPSR returns the Exception number, see Section 2.1.3.6.2 Interrupt Program 
Status Register. 


° For configurable priority values, see Section 4.2.7 Interrupt Priority Registers. 


For an asynchronous exception, other than reset, the processor can execute extra instructions between the 
moment the exception is triggered and the moment the processor enters the exception handler. 


Privileged software can disable the exceptions that have configurable priority, as shown in the table above. 
An exception that targets Secure state cannot be disabled by Non-secure code. 


Reset The exception model treats reset as a special form of exception. When either power-on or 
warm reset is asserted, the operation of the processor stops, potentially at any point in an 
instruction. When reset is deasserted, execution restarts from the address provided by the 
reset entry in the vector table. Execution restarts as privileged execution in Thread mode. 


NMI A Non-Maskable Interrupt (NMI) can be signaled by a peripheral or triggered by software. This 
is the highest priority exception other than reset. It is permanently enabled and has a fixed 
priority of -2. NMIs cannot be masked or preempted by any exception other than Reset. 


HardFault A HardFault is an exception that occurs because of an error during exception processing, or 
because an exception cannot be managed by any other exception mechanism. HardFaults 
have a fixed priority of -1, meaning they have higher priority than any exception with 
configurable priority. 
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MemManage A MemManage fault is an exception that occurs because of a memory protection violation, 
compared to the MPU or the fixed memory protection constraints, for both instruction and data 
memory transactions. This fault is always used to abort instruction accesses to Execute Never 
(XN) memory regions. 


BusFault A BusFault is an exception that occurs because of a memory-related fault for an instruction or 
data memory transaction. This might be from an error that is detected on a bus in the memory 
system. 

UsageFault A UsageFault is an exception that occurs because of a fault related to instruction execution. 


This includes: 


° An undefined instruction. 

. An illegal unaligned access. 

. Invalid state on instruction execution. 
° An error on exception return. 


The following can cause a UsageFault when the core is configured by software to report them: 
. An unaligned address on word and halfword memory access. 
. Division by zero. 


SVCall A Supervisor Call (SVC) is an exception that is triggered by the SVC instruction. In an OS 
environment, applications can use SVC instructions to access OS kernel functions and device 
drivers. 

DebugMonitor A DebugMonitor exception. If Halting debug is disabled and the debug monitor is enabled, a 


debug event causes a DebugMonitor exception when the group priority of the DebugMonitor 
exception is greater than the current execution priority. 


PendSV PendSV is an asynchronous request for system-level service. In an OS environment, use 
PendSV for context switching when no other exception is active. 


SysTick A SysTick exception is an exception the system timer generates when it reaches zero. Software 
can also generate a SysTick exception. In an OS environment, the processor can use this 
exception as a system tick. 


Interrupt (IRQ) An interrupt, or IRQ, is an exception signaled by a peripheral, or generated by a software 
request. All interrupts are asynchronous to instruction execution. In the system, peripherals use 
interrupts to communicate with the processor. 


Table 22. Properties of the different exception type without the Security Extensions 


Exer plo nunlPes Re number Exception type Priority AV(=Yos oy mr-Le (ol g-t-s-) Activation 
(see notes) (see notes) 


Reset -4, the highest 0x00000004 Asynchronous 
2 -14 NMI -2 0x00000008 Asynchronous 
3 -13 HardFault -1 0x0000000C Synchronous 
4 -12 MemManage Configurable | 0x00000010 Synchronous 


Synchronous when 
ie) -11 BusFault Configurable | 0x00000014 precise, asynchronous 
when imprecise 


6 -10 UsageFault Configurable | 0x00000018 Synchronous 
7-10 - Reserved - - - 
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SVCall Configurable | 0x0000002C Synchronous 
12 -4 DebugMonitor | Configurable | 0x00000030 Synchronous 
13 - Reserved - - - 
14 -2 PendSV Configurable | 0x00000038 Asynchronous 
5 -1 SysTick Configurable | 0x0000003C Asynchronous 
16 and above 0 and above Interrupt (IRQ) | Configurable ew BueeT eve: Asynchronous 
Increasing in steps of 4 
Note: ° To simplify the software layer, the CMSIS only uses IRQ numbers. It uses negative values for exceptions 
other than interrupts. The IPSR returns the Exception number, see Section 2.1.3.6.2 Interrupt Program 


Status Register. 
° For configurable priority values, see Section 4.2.7 Interrupt Priority Registers. 


For an asynchronous exception, other than reset, the processor can execute extra instructions between the 
moment the exception is triggered and the moment the processor enters the exception handler. 


Privileged software can disable the exceptions that have configurable priority, as shown in the table above. 


2.4.3 Exception handlers 


The exception handlers are the following: 


Interrupt Service Routines Interrupts IRQ0-IRQ479 are the exceptions that are handled by ISRs. 


(ISRs) Each interrupt is configured by Secure software in Secure or Non-secure state, using 
NVIC_ITNS. 

Fault handler The fault handler handles the following exceptions: 
° HardFault. 


° MemManage. 

° BusFault. 

° UsageFault. 

. SecureFault. 

There can be separate MemManage and UsageFault handlers in Secure and Non-secure state. 


The AIRCR.BFHFNMINS bit controls the target state for HardFault and BusFault. SecureFault 
always targets Secure State. 


System handlers The system handlers handle the following system exceptions: 
° NMI. 
° PendSV. 
: SVCall. 
° SysTick. 


Most system handlers can be banked with separate handlers between Secure and Non-secure 
state. The AIRCR.BFHFNMINS bit controls the target state for NMI. 


2.4.4 Vector table 


The Vector Table Offset Register (VTOR) in the System Control Block (SCB) determines the starting address of 
the vector table. The VTOR is banked so there is a VTOR_S and a VTOR_NS. The initial values of VTOR_S and 
VTOR_NS are system design specific. The vector table used depends on the target state of the exception. For 
exceptions targeting the Secure state, VTOR_S is used. For exceptions targeting the Non-secure state, 
VTOR_NS is used. The Vector Table Offset Register (VTOR) in the System Control Block (SCB) determines the 
starting address of the vector table. 
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The following figure shows the order of the exception vectors in the vector table. The least-significant bit of each 
vector is 1, indicating that the exception handler is written in Thumb code. 


Figure 7. Vector table 
























































Exception number IRQ number Vector Offset 
463 479 IRQ479 Ox7BC 
18 2 IRQ2 0x48 
17 1 IRQ1 0x44 
16 0 IRQO 0x40 
15 -1 SysTick 0x3C 
14 -2 PendSV 0x38 
13 Reserved 0x30 

12 -4 DebugMonitor 

11 -5 SVCall Ox2c 

10 

9 

7 Reserved 

7 

6 -11 UsageFault 0x18 

5 12 BusFaults 0x14 

4 -13 MemManage 0x10 

3 -13 HardFault 0x0c 

2 -14 NMI 0x08 

1 Reset 0x04 
Initial SP value 0x00 











On system reset the vector table is set to the value of the external INITNSVTOR bus. Privileged software can 
write to VTOR to relocate the vector table start address to a different memory location, in the range 0x00000000 
to OxFFFFFF80, assuming access is allowed by the external LOCKNSVTOR pin. 

The silicon vendor must configure the required alignment, which depends on the number of interrupts 
implemented. The minimum alignment is 32 words, enough for up to 16 interrupts. For more interrupts, adjust the 
alignment by rounding up to the next power of two. For example, if you require 21 interrupts, the alignment must 
be on a 64-word boundary because the required table size is 37 words, and the next power of two is 64. 


The following figure shows the order of the exception vectors in the Secure and Non-secure vector tables. The 
least-significant bit of each vector is 1, indicating that the exception handler is written in Thumb code. 
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Figure 8. Vector table 






























































Exception number IRQ number re Vector Non-sec Ve Offset 
463 479 IRQ479 IRQ479 Ox7BC 
18 2 IRQ2 IRQ2 0x48 
17 1 IRQ1 .Q 0x44 
16 0 IRQO RQ 0x40 
15 -1 SysTick_S sTick_N Ox3c 
14 -2 PendSV_S iSV_NS 0x38 
13 Reser Reserve 0x30 
12 -3 DebugMonitor 
1 5 SVCall_S $VCall_NS Ox2c 
10 
9 Reserved 
8 
7 9 SecureFault Oxic 
6 -11 UsageFault_S JsageFault 0x18 
5 -12 BusFault_S usFault_NS 0x14 
4 -13 MemManage_S MemMan TS 0x10 
3 -13 HardFault_S ardFault_NS Ox0c 
2 -14 NMI_S NMI_NS 0x08 
1 Reset 0x04 

Initial SP value 0x00 











Because reset always targets Secure state, the Non-secure Reset and Non-secure Initial SP value are ignored by 
the hardware. 


On system reset, the Non-secure vector table is set to the value of the external INITNSVTOR bus, and the Secure 
vector table is set to the value of the external INITSVTOR bus. Privileged software can write to VTOR_S and 
VTOR_NS to relocate the vector table start address to a different memory location, in the range 0x00000000 to 
OxFFFFFF80, assuming access is allowed by the external LOCKNSVTOR and LOCKSVTAIRCR pins 
respectively. 

The silicon vendor must configure the required alignment of the vector tables, which depends on the number of 
interrupts implemented. The minimum alignment is 32 words, enough for up to 16 interrupts. For more interrupts, 
adjust the alignment by rounding up to the next power of two. For example, if you require 21 interrupts, the 
alignment must be on a 64-word boundary because the required table size is 37 words, and the next power of two 
is 64. 


Exception priorities 


All exceptions have an assigned priority that is used to control both pre-emption and prioritization between 
pending exceptions. A lower priority value indicates a higher priority. You can configure priorities for all exceptions 
except Reset, HardFault, and NMI. 

If software does not configure any priorities, then all exceptions with a configurable priority have a priority of 0. For 
information about configuring exception priorities, see: 

° Section 4.3.10 System Handler Priority Registers. 

° Section 4.2.7 Interrupt Priority Registers. 


Configurable priorities are in the range 0-255. The Reset, HardFault, and NMI exceptions, with fixed negative 
priority values always have higher priority than any other exception. 

<Directions for licensee: The 0-255 number is a licensee-configured value. If the device implements fewer than 
8 bits of priority, the licensee must change the number 0-255 to 127, 63, 31, 15 or 7 to correspond to the number 
of bits implemented (7 down to 3 respectively).> 
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For configurable priority exceptions, the target Security state also affects the programmed priority. Depending on 
the value of AIRCR.PRIS, the priority can be extended. 


In the table, the values in columns 2 and 3 must match, and increase from zero in increments of 32. The values in 
column 4 start from 128 and increase in increments of 16. 


Table 23. Extended priority 


Priority value [7:5] | Secure priority Non-secure ii ae AIRCR.PRIS | Non-secure alate AIRCR.PRIS 
0 0 0 


128 
1 32 32 144 
2 64 64 160 
3 96 96 176 
4 128 128 192 
5 160 160 208 
6 192 192 224 
7 224 224 240 


Assigning a higher priority value to IRQ[0] and a lower priority value to IRQ[1] means that IRQ[1] has higher 
priority than IRQ([O]. If both IRQ[1] and IRQ[0] are asserted, IRQ[1] is processed before IRQ[O]. 

If multiple pending exceptions have the same priority, the pending exception with the lowest exception number 
takes precedence. For example, if both IRQ[0] and IRQ[1] are pending and have the same priority, then IRQ[O] is 
processed before IRQ[‘]. 

When the processor is executing an exception handler, the exception handler is preempted if a higher priority 
exception occurs. If an exception occurs with the same priority as the exception being handled, the handler is not 
preempted, irrespective of the exception number. However, the status of the new interrupt changes to pending. 


Interrupt priority grouping 


To increase priority control in systems with interrupts, the NVIC supports priority grouping. This divides each 
interrupt priority register entry into two fields, an upper field that defines the group priority, and a lower field that 
defines a subpriority within the group. 


Only the group priority determines pre-emption of interrupt exceptions. When the processor is executing an 
interrupt exception handler, another interrupt with the same group priority as the interrupt being handled does not 
pre-empt the handler. 


If multiple pending interrupts have the same group priority, the subpriority field determines the order in which they 
are processed. If multiple pending interrupts have the same group priority and subpriority, the interrupt with the 
lowest IRQ number is processed first. 


If a pending Secure exception and a pending Non-secure exception both have the same group priority field value, 
the same subpriority field value, and the same exception number, the Secure exception takes precedence. 
Exception entry and return 


Descriptions of exception handling use the following terms. 


An exception can preempt the current execution if its priority is higher than the current 
execution priority. 


When one exception preempts another, the exceptions are called nested exceptions. 


This occurs when the exception handler is completed. 


The processor pops the stack and restores the processor state to the state it had before the 
interrupt occurred. 
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This mechanism speeds up exception servicing. On completion of an exception handler or 
during the return operation, if there is a pending exception that meets the requirements for 
exception entry, then the stack pop is skipped and control transfers directly to the new 
exception handler. 


interrupts This mechanism speeds up preemption. If a higher priority exception occurs during state saving 
for a previous exception, the processor switches to handle the higher priority exception and 
initiates the vector fetch for that exception. State saving may be affected by the late arrival 
depending on the stacking requirements of the original exception and the late-arriving 
exception. On return from the exception handler of the late-arriving exception, the normal tail- 
chaining rules apply. 


Exception entry 


Exception entry occurs when there is a pending exception with sufficient priority and either the processor is in 
Thread mode, or the new exception is of higher priority than the exception being handled, in which case the new 
exception preempts the original exception. 

When one exception preempts another, the exceptions are nested. 

Sufficient priority means that the exception has higher priority than any limits set by the mask registers. An 
exception with lower priority than this is pending but is not handled by the processor. 

When the processor takes an exception, unless the exception is a tail-chained or a late-arriving exception, the 
processor pushes information onto the current stack. This operation is referred to as stacking and the structure of 
the data stacked is referred as the stack frame. 

If the floating-point context is active, the Cortex-M33 processor can automatically stack the architected floating- 
point state on exception entry. The following figure shows the Cortex-M33 processor stack frame layout when an 
interrupt or an exception is preserved on the stack: 

° with floating-point state. 

. without floating-point state. 


Where stack space for floating-point state is not allocated, the stack frame is the same as that of Armv8-M 
implementations without an FPU. 
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Figure 9. Stack frame when an interrupt or an exception is preserved on the stack with or without floating- 
point state 




















































































































SP offset 0x68 + = OriginalSPt SP offset 0x20 + Original SPtt 
0x64 Reserved Oxic xXPSR 
0x60 FPSCR 0x18 PC 
Ox5¢ $15 0x14 LR (R14) 
0x58 S14 0x10 R12 
0x54 S13 ox0c R3 ee 
0x50 $12 0x08 R2 
Ox4c $11 0x04 R1 
0x48 S10 0x00 RO 
ae = FP context Exception frame without 
a S8 floating-point storage 
0x3c S7 
0x38 S6 
0x34 S5 
0x30 S4 
Ox2c S3 
0x28 $2 
0x24 S1 
0x20 so = 
Ox1c xPSR 
0x18 PC 
0x14 LR (R14) 
a nie State context 
Ox0c R3 
0x08 R2 
0x04 R1 
0x00 RO 














Exception frame with 
floating-point storage 


t Or at offset Ox6C if at a word-aligned but not tt Or at offset 0x24 if at a word-aligned but not 
doubleword-aligned address. doubleword-aligned address. 


When a Non-secure exception preempts a Secure context, additional context is saved onto the stack and the 
stacked registers are cleared to ensure no Secure data is available to Non-secure software. 


If the Security Extension is implemented, when a Non-secure exception preempts software running in a Secure 
state, additional context is saved onto the stack and the stacked registers are cleared to ensure no Secure data is 
available to Non-secure software, as the following figure shows. 
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Figure 10. Stack frame extended to save additional context when the Security Extension is implemented 


SP offset 0x48 
0x44 
0x40 
0x3c 
0x38 
0x34 
0x30 
Ox2c 
0x28 
0x24 
0x20 
Ox1ic 
0x18 
0x14 
0x10 
0x0c 
0x08 
0x04 
0x00 





xPSR 
PC 





LR (R14) 





R12 





R3 





R2 
R1 





RO 


+ Original SPt 
cams. 


State context 





R11 





R10 





R9 





R8 





R7 





R6 





RS 





R4 





Reserved 








Integrity signature 





Additional 
state context 





+ New SP 





t Or at offset 0x4C if at a word-aligned but not 
doubleword-aligned address. 


If the floating-point context is active, the Cortex-M33 processor automatically stacks floating-point state in the 
stack frame. There are two frame formats that contain floating-point context. If an exception is taken from Secure 
state and FPCCR.TS is set, the additional floating-point context is stacked. In all other cases, only the standard 
floating-point context is stacked, as the following figure shows. 


The conditions that trigger saving additional FP context are different from those that trigger additional integer 


context. 
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Figure 11. Extended exception stack frame 

























































































































































































































































































Stack frame for Secure floating-point state when FPCCR.TS = 1 Stack frame for Secure floating-point state when FPCCR.TS = 0 
SP offset OxDO + Original SPt SP offset 0x90 << Original SPtt 
Oxcc $31 Ox8c | Reserved | 
Oxc8 $30 0x88 FPSCR 
Oxc4 $29 0x84 $15 
OxcO S28 0x80 $14 
OxBC $27 Ox7¢ $13 
OxB8 S26 0x78 $12 
OxB4 $25 0x74 sit 
pases =e Additional FP context 0x70 S10 
OxAC $23 Ox6C so 
Oxas S22 0x68 38 FP context 
OxA4 $21 0x64 S7 
0xA0 $20 0x60 S6 
Ox9Cc $19 Ox5C S5 
0x98 S18 0x58 S4 
0x94 S17 0x54 S3 
0x90 S16 0x50 S2 
Ox8c Reserved ~ 0x4c S1 
0x88 FPSCR 0x48 So 
0x84 $15 0x44 xPSR’ 
0x80 $14 0x40 PC 
Ox7C $13 0x3c LR (R14) 
0x78 $12 0x38 R12 
0x74 Sit 0x34 R3 State context 
0x70 $10 0x30 R2 
moe ey FP context Ox2c Rt 
0x68 S8 0x28 RO 
0x64 S7 0x24 R11 x 
0x60 S6 0x20 R10 
Ox5c $5 Ox1c RQ 
0x58 S4 0x18 R8 
0x54 $3 0x14 R7 oe 
0x50 $2 0x10 Re Additional state context 
Ox4c $1 Ox0c R5 
0x48 so 0x08 R4 
0x44 xPSR 0x04 Reserved 
0x40 PC 0x00 __| Integrity signature < New SP 
Ox3C LR (R14) 
gas Bie State context 
0x34 R3 
0x30 R2 
Ox2c R1 
0x28 RO 
0x24 R11 
0x20 R10 
Oxic RQ 
0x18 R8 
peal lias Additional state context 
0x10 R6 
es = t Or at offset OxD4 if at a word-aligned but not doubleword-aligned address. 
0x08 R4 
0x04 Reserved tt Or at offset 0x94 if at a word-aligned but not doubleword-aligned address. 
0x00 | Integrity signature + New SP 














The Stack pointer of the interrupted thread or handler is always used for stacking the state before the exception is 
taken. For example if an exception is taken from Secure state to a Non-secure handler the Secure stack pointer is 
used to save the state. 


Immediately after stacking, the stack pointer indicates the lowest address in the stack frame. 


The stack frame includes the return address. This is the address of the next instruction in the interrupted program. 
This value is restored to the PC at exception return so that the interrupted program resumes. 
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In parallel to the stacking operation, the processor performs a vector fetch that reads the exception handler start 

address from the vector table. When stacking is complete, the processor starts executing the exception handler. 

At the same time, the processor writes an EXC_RETURN value to the LR. This value is used to trigger exception 
return when the exception handler is complete. 


If no higher priority exception occurs during exception entry, the processor starts executing the exception handler 
and automatically changes the status of the corresponding pending interrupt to active. 


If another higher priority exception occurs during exception entry, the processor starts executing the exception 
handler for this exception and does not change the pending status of the earlier exception. This is the late arrival 
case. 


2.4.7.2 Exception return 


Exception return occurs when the processor is in Handler mode and execution of one of the following instructions 
attempts to set the PC to an EXC_RETURN value: 


° A POP or LDM instruction that loads the PC. 
° An LDR instruction that loads the PC 
. A 8X instruction using any register. 


The processor saves an EXC_RETURN value to the LR on exception entry. The exception mechanism relies on 
this value to detect when the processor has completed an exception handler. When the processor loads a value 
matching this pattern to the PC it detects that the operation is not a normal branch operation and, instead, that the 
exception is complete. As a result, it starts the exception return sequence. Bits[6:0] of the EXC_RETURN value 
indicate the required return stack, processor mode, Security state, and stack frame as the following table shows. 


Table 24. Exception return behavior 


Ps [ame cto 


Indicates that this is an EXC_RETURN value. 
This field reads as 0b11111111. 
[23:7] | - Reserved, RES17. 


[31:24] | PREFIX 


Indicates whether registers have been pushed to a Secure or Non-secure stack. 


[6] iS) 0 Non-secure stack used. 


1 Secure stack used. 


Indicates whether the default stacking rules apply, or whether the callee registers are already on the stack. 


[5] DCRS |0 Stacking of the callee saved registers is skipped. 


1 Default rules for stacking the callee registers are followed. 


In a PE with the Main and Floating-point Extensions: 


0 The PE allocated space on the stack for FP context. 
[4] FType 
1 The PE did not allocate space on the stack for FP context. 
In a PE without the Floating-point Extension, this bit is Reserved, RES7. 
Indicates the mode that was stacked from. 
[3] Mode 0 Handler mode. 
1 Thread mode. 
[2] SPSEL _ Indicates which stack contains the exception stack frame. 
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0 Main stack pointer. 
A Process stack pointer. 
[1] - Reserved, RESO. 


Indicates the Security state the exception was taken to. 
[0] ES 0 Non-secure. 


1 Secure. 


The processor saves an EXC_RETURN value to the LR on exception entry. The exception mechanism relies on 
this value to detect when the processor has completed an exception handler. When the processor loads a value 
matching this pattern to the PC it detects that the operation is not a normal branch operation and, instead, that the 
exception is complete. As a result, it starts the exception return sequence. Bits[6:0] of the EXC_RETURN value 
indicate the required return stack, processor mode, and stack frame as the following table shows. 


Table 25. Exception return behavior 


Fis ame euros 


Indicates that this is an EXC_RETURN value. 
[31:24] | PREFIX 
This field reads as 0611111111. 


[23:7] | - Reserved, RES17. 
[6] - Reserved, RESO. 
[5] - Reserved, RES17. 


In a PE with the Main and Floating-point Extensions: 


0 The PE allocated space on the stack for FP context. 
[4] FType 
1 The PE did not allocate space on the stack for FP context. 
In a PE without the Floating-point Extension, this bit is Reserved, RES7. 
Indicates the mode that was stacked from. 
[3] Mode 0 Handler mode. 
1 Thread mode. 
Indicates which stack contains the exception stack frame. 
[2] SPSEL |0 Main stack pointer. 
1 Process stack pointer. 
[1:0] - Reserved, RESO. 
2.5 Security state switches 


The following table presents the possible security transitions, the instructions that can cause them, and any faults 
that may be generated. 
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Table 26. Security state transitions 


Current Security attribute of the Security tate change 
Security state branch target address y 9 
Change to Non-secure state if the branch was a BXNS or BLXNS instruction, 
Secure Non-secure with the Isb of its target address set to 0. 
Otherwise, a SecureFault is generated. 


Change to Secure state if the branch target address contains an SG 
Secure and Non-secure 


Non-secure instruction. 
callable 


If the target address does not contain an SG a SecureFault is generated. 


Secure and not Non-secure : 
Non-secure nallable A SecureFault is generated. 


The following figure shows the Security state transitions: 


Figure 12. Security state transitions 


BLXNS-call to Non-secure function 











Non-secure 
state 























BX to FNC_RETURN-return from Non-secure function 


Secure software can call a Non-secure function using the BLXNS instruction. When this happens, the LR is set to 
a special value called FNC_RETURN, and the return address and XPSR is saved onto the Secure stack. Return 
from Non-secure state to Secure state is triggered when one of the following instructions attempts to set the PC to 
an FNC_RETURN value: 


° A POP or LDM instruction that loads the PC. 

. An LDR instruction that loads the PC. 

. A BX instruction using any register. 

When a return from Non-secure state to Secure state occurs the processor restores the program counter and 
XPSR from the Secure stack. 

Any scenario not listed in the table triggers a SecureFault. For example: 

° Sequential instructions that cross security attributes from Secure to Non-secure. 

° A 32-bit instruction fetch that crosses regions with different security attributes. 
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Fault handling 


Faults can occur on instruction fetches, instruction execution, and data accesses. When a fault occurs, 
information about the cause of the fault is recorded in various registers, according to the type of fault. Faults are a 
subset of the exceptions. 


Faults are generated by: 


2.6.1 


A bus error on: 
An instruction fetch or vector table load. 
A data access. 


An internally-detected error such as an undefined instruction. 
Attempting to execute an instruction from a memory region marked as Execute Never (XN). 
A privilege violation or an attempt to access an unmanaged region causing an MPU fault. 


A security violation. 


Fault types reference table 


The table shows the types of fault, the handler used for the fault, the corresponding fault status register, and the 
register bit that indicates that the fault has occurred. 
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Table 27. Faults 


Bus error on a vector read 
HardFault 
Fault escalated to a hard fault 
MPU or default memory map mismatch: 
On instruction access 
On data access 
MemManage 
During exception stacking 
During exception unstacking 
During lazy floating-point state preservation 
Bus error: 
During exception stacking 
During exception unstacking 
During instruction prefetch BusFault 
During lazy floating-point state preservation 
Precise data bus error 
Imprecise data bus error 
Undefined instruction 
Attempt to enter an invalid instruction set state (?) 
Invalid EXC_RETURN value 
UsageFault 
Illegal unaligned load or store 
Stack overflow flag 
Divide By 0 
Lazy state error flag 
Lazy state preservation error flag SecureFault 


Invalid transition flag 


VECTTBL 
FORCED 
IACCVIOL “") 
DACCVIOL 
MSTKERR 
MUNSKERR 
MLSPERR 
STKERR 
UNSTKERR 
IBUSERR 
LSPERR 
PRECISERR 
IMPRECISERR 
UNDEFINSTR 
INVSTATE 
INVPC 
UNALIGNED 
STKOF 
DIVBYZERO 
LSERR 
LSPERR 
INVTRAN 


Section 4.3.13 HardFault Status Register 


Section 4.3.12.1 MemManage Fault 
Status Register 


Section 4.3.12.2 BusFault Status Register 


Section 4.3.12.3 UsageFault Status 
Register 


Section 4.5.7 Secure Fault Status 
Register 
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Attribution unit violation flag AUVIOL 

Invalid exception return flag INVER Section 4.5.7 Secure Fault Status 
SecureFault Rieaistar 

Invalid integrity signature flag INVIS 9 

Invalid entry point INVEP 


1. Occurs on an access to an XN region even if the processor does not include an MPU or the MPU is disabled. 


2. Attempting to use an instruction set other than the T32 instruction set or returns to a non load/store-multiple instruction with 
ICI continuation. 


2.6.2 Fault escalation to HardFault 
All fault exceptions other than HardFault have configurable exception priority. Software can disable execution of 
the handlers for these faults. 
Usually, the exception priority, together with the values of the exception mask registers, determines whether the 
processor enters the fault handler, and whether a fault handler can preempt another fault handler. 


In some situations, a fault with configurable priority is treated as a HardFault. This is called priority escalation, and 

the fault is described as escalated to HardFault. Escalation to HardFault occurs when: 

. A fault handler causes the same kind of fault as the one it is servicing. This escalation to HardFault occurs 
because a fault handler cannot preempt itself; it must have the same priority as the current execution priority 
level. 

. A fault handler causes a fault with the same or lower priority as the fault it is servicing. This is because the 
handler for the new fault cannot preempt the currently executing fault handler. 


. An exception handler causes a fault for which the priority is the same as or lower than the currently 
executing exception. 


° A fault occurs and the handler for that fault is not enabled. 


If a BusFault occurs during a stack push when entering a BusFault handler, the BusFault does not escalate to a 
HardFault. This means that if a corrupted stack causes a fault, the fault handler executes even though the stack 
push for the handler failed. The fault handler operates but the stack contents are corrupted. 


The faults and fixed priority exceptions are also designated as Secure or Non-secure under the control of 
AIRCR.BFHFMNINS. When AIRCR.BFHFMNINS is set to: 


0 BusFaults and fixed priority exceptions are designated as Secure. The exceptions retain the 
prioritization of HardFault at -1 and NMI at -2. 


A BusFaults and fixed priority exceptions are designated as Non-secure. In this case, Secure 
HardFault is introduced at priority -3 to ensure that faults that target Secure state are 
recognized. 


The Non-secure state cannot inhibit BusFaults and fixed priority exceptions which target Secure state. Therefore 
when faults and fixed priority exceptions are Secure, Non-secure FAULTMASK (FAULTMASK_NS) only inhibits 
programmable priority exceptions, making it equivalent to Non-secure PRIMASK (PRIMASK_NS). 

Non-secure programmable priority exceptions are mapped to the regular priority range 0-255, if AIRCR.PRIS is 
clear. Non-secure programmable priority exceptions are mapped to the bottom half the regular priority range, 
128-255, if AIRCR.PRIS is set to 1. Therefore the FAULTMASK_NS sets the execution priority to 0 or 80, 
according to AIRCR.PRIS, to mask the Non-secure programmable priority exception only. 

When BusFaults and fixed priority exceptions are Secure, FAULTMASK_S sets execution priority to -1 to inhibit 
everything up to and including HardFault. 

When BusFaults and fixed priority exceptions are designated as Non-secure, FAULTMASK_NS boosts priority to 
-1 to inhibit everything up to Non-secure HardFault at priority -1, while FAULTMASK_S boosts priority to -3 to 
inhibit all faults and fixed priority exceptions including the Secure HardFault at priority -3. 


Note: Only Reset can preempt the fixed priority Secure HardFault when AIRCR.BFHFNMINS is set to 1. A Secure 
HardFault when AIRCR.BFHFNMINS is set to 1 can preempt any exception other than Reset. A Secure 
HardFault when AIRCR.BFHFNMINS is set to 0 can preempt any exception other than Reset, NMI, or another 
HardFault. 
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2.6.3 Fault status registers and fault address registers 


The fault status registers indicate the cause of a fault. For BusFaults, and MemManage faults, the fault address 
register indicates the address that is accessed by the operation that caused the fault. The fault status registers 
indicate the cause of a fault. For BusFaults, SecureFaults, and MemManage faults, the fault address register 
indicates the address that is accessed by the operation that caused the fault. 

The processor has two physical fault address registers. One shared between the MMFAR_S, SFAR, and BFAR 
(only if AIRCR.BFHFNMINS is set to 0), and the other shared between the MMFAR_NS and BFAR (only if 
AIRCR.BFHFNMINS is set to 1). These are targeted by Secure and Non-secure faults respectively. 


The processor has one physical fault address register. It is shared between the MMFAR and BFAR. 


For each physical fault address register, it is only possible to report the address of one fault at a time. Each fault 
address register is updated when one of the *FARVALID bits is set for their respective faults in the associated 
*FSR register. Any fault that targets a fault address register with one of its *FARVALID bits already set does not 
update the fault address. The *FARVALID bits must be cleared before another fault address can be reported. 


The following table shows the fault status and fault address registers. 


Table 28. Fault status and fault address registers 


| Handler | Status register name | Address register name Register description 


HardFault HFSR Section 4.3.13 HardFault Status Register 

Section 4.3.12.1 MemManage Fault Status Register 
MemManage | MMFSR‘") MMFAR") 

Section 4.3.14 MemManage Fault Address Register 

Section 4.3.12.2 BusFault Status Register 
BusFault BFSR BFAR 

Section 4.3.15 BusFault Address Register 
UsageFault = UFSR") - Section 4.3.12.3 UsageFault Status Register 

Section 4.5.7 Secure Fault Status Register 
SecureFault | SFSR SFAR 


Section 4.5.8 Secure Fault Address Register 


1. MMFSR, MMFAR, and UFSR are banked between Security states. 


2.6.4 Lockup 


The processor enters a lockup state if a fault occurs when it cannot be serviced or escalated. When the processor 
is in lockup state, it does not execute any instructions. 


The processor remains in lockup state until either: 

. It is reset. 

. Preemption by a higher priority exception occurs. 
. It is halted by a debugger. 


Note: If lockup state occurs from a Secure HardFault when AIRCR.BFHFNMINS is set to 1 or the NMI handler, a 
subsequent NMI does not cause the processor to leave lockup state. 


2.7 Power management 


The Cortex-M33 processor supports modes for sleep and deep sleep that reduce power consumption. Sleep 

mode stops the processor clock. Deep sleep mode stops the system clock and switches off the PLL and flash 
memory. 

The SCR.SLEEPDEEP bit selects which sleep mode is used. For more information about the behavior of the 
sleep modes, see Section 4.3.8 System Control Register. 


27.4 Entering sleep mode 


The system can generate spurious wakeup events. Therefore, software must be able to put the processor back 
into sleep mode after such an event. A program might have an idle loop to put the processor back to sleep mode. 
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2.7.1.1 Wait for interrupt 


The wait for interrupt instruction, WFI, causes immediate entry to sleep mode unless the wakeup condition is true. 
When the processor executes a WFI instruction, it stops executing instructions and enters sleep mode. 


2112 Wait for event 





The wait for event instruction, WFE, causes entry to sleep mode depending on the value of a one-bit event 
register. 


When the processor executes a WFE instruction, it checks the value of the event register: 





0 The processor stops executing instructions and enters sleep mode. 
a The processor clears the register to 0 and continues executing instructions without entering 
sleep mode. 





If the event register is 1, it indicates that the processor must not enter sleep mode on execution of a WFE 
instruction. Typically, this is because an external event signal is asserted, or a processor in the system has 
executed an SEV instruction. 





27:4:3 Sleep-on-exit 


If the SLEEPONEXIT bit of the SCR is set to 1, when the processor completes the execution of all exception 
handlers, it immediately enters sleep mode without restoring the Thread context from the stack. Use this 
mechanism in applications that only require the processor to run when an exception occurs. 


2.7.2 Wakeup from sleep mode 
The conditions for the processor to wake up depend on the mechanism that causes it to enter sleep mode. 


2.7.2.1 Wakeup from WFI or sleep-on-exit 


Normally, the processor wakes up only when it detects an exception with sufficient priority to cause exception 
entry. Some embedded systems might have to execute system restore tasks after the processor wakes up, and 
before it executes an interrupt handler. To achieve this set the PRIMASK bit to 1 and the FAULTMASK bit to 0. If 
an interrupt arrives that is enabled and has a higher priority than the current exception priority, the processor 
wakes up but does not execute the interrupt handler until the processor sets PRIMASK to zero. 


2.7.2.2 Wakeup from WFE 
Conditions which cause the processor to wakeup from WFE. 
The processor wakes up if: 


° It detects an exception with sufficient priority to cause exception entry. 
° It detects an external event signal. 
° In a multiprocessor system, another processor in the system executes an SEV instruction. 





In addition, if the SEVONPEND bit in the SCR is set to 1, any new pending interrupt triggers an event and wakes 
up the processor, even if the interrupt is disabled or has insufficient priority to cause exception entry. 


2.7.3 The external event input 


The processor provides an external event input signal. Peripherals can drive this signal, either to wake the 
processor from WFE, or to set the internal WFE event register to 1 to indicate that the processor must not enter 
sleep mode on a later WFE instruction. 


2.7.4 Power management programming hints 
ISO/IEC C cannot directly generate the WF I and WFE instructions. 





The CMSIS provides the following functions for these instructions: 


void _ WFE(void) // Wait for Event 
void _ WFI(void) // Wait for Interrupt 
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3 The Cortex®-M33 Instruction Set 


3.1 Instruction set summary 


The T32 instruction set is supported by the Cortex-M33 processor. 


Note: 


In the following table: 


Angle brackets, <>, enclose alternative forms of the operand. 


Braces, {}, enclose optional operands. 
The Operands column is not exhaustive. 


Op2 is a flexible second operand that can be either a register or a constant. 
Most instructions can use an optional condition code suffix. 


For more information on the instructions and operands, see the instruction descriptions. 


Table 29. Cortex-M33 instruction set summary 


A 


A 


A 


ADC, 


DD, 


DD, 


DR 





AND, 


ASR, 


ADCS 


ADDS 


ADDW 


ANDS 


ASRS 


B {cond} 


BFC 


BFI 


BIC, 


BKPT 


BI 


LX 





LXNS 


BX 


BXNS 


CBNZ 


CBZ 


PM0264 - Rev 1 


BICS 


{Rd, } Rn, Op2 


{Rd, } Rn, Op2 


{Rd, } Rn, #imm12 


Rd, label 


{Rd, } Rn, Op2 


Rd, Rm, <Rs|#n> 


label 


Rd, #1sb, #width 


Rd, Rn, #1sb, 
#width 


{Rd, } Rn, Op2 
#imm8 


label 


Rm 


Rn, label 


Rn, label 


Add with Carry 


Add 


Add 
Address to Register 


Logical AND 


Arithmetic Shift Right 


Branch {conditionally} 


Bit Field Clear 


Bit Field Insert 


Bit Clear 
Breakpoint 


Branch with Link 


Branch indirect with Link 


and Exchange 


Branch indirect with Link 
and Exchange, Non-secure 


Branch and Exchange 


Branch and Exchange, 


Non-secure 


Compare and Branch on 


Non Zero 


Compare and Branch on 


Zero 


N,Z,C,V 


N,Z,C,V 


N,Z,C 


N,Z,C 


N,Z,C 


Section 3.4.1 ADD, ADC, SUB, 
SBC, and RSB 


Section 3.4.1 ADD, ADC, SUB, 
SBC, and RSB 


Section 3.4.1 ADD, ADC, SUB, 
SBC, and RSB 


Section 3.12.1 ADR 


Section 3.4.2 AND, ORR, EOR, 
BIC, and ORN 


Section 3.4.3 ASR, LSL, LSR, 
ROR, and RRX 


Section 3.9.2 B, BL, BX, and 
BLX 


Section 3.8.1 BFC and BFI 


Section 3.8.1 BFC and BFI 


Section 3.4.2 AND, ORR, EOR, 
BIC, and ORN 


Section 3.11.1 BKPT 


Section 3.9.2 B, BL, BX, and 
BLX 


Section 3.9.2 B, BL, BX, and 
BLX 


Section 3.9.3 BXNS and BLXNS 


Section 3.9.2 B, BL, BX, and 
BLX 


Section 3.9.3 BXNS and BLXNS 


Section 3.9.4 CBZ and CBNZ 


Section 3.9.4 CBZ and CBNZ 
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CLREX 





CLZ 
CMN 


CMP 


CPSID 


CPSIE 


DMB 


DSB 


EOR, EORS 


FLDMDBX ,FLDMIAX 


FSTMDBX,FSTMIAX 


ISB 


LT 
LDA 


LDAB 


LDAEX 


LDAEXB 


LDAEXH 


LDAH 


.DMDB, LDMEA 








iDMIA, LDMFD 





LDR, LDRT 


LDRB 








LDRB 
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Rd, Rm 


| Rn, Op2 


Rn, Op2 


{opt} 


{opt} 


{Rd, } Rn, Op2 

















Rn 

Rn 

{opt} 

Rd, [Rn] 

Rd, [Rn] 

Rd, [Rn] 

Rd, [Rn] 

Rd, [Rn] 

Rd, [Rn] 

Rn{!}, reglist 
Rn{!}, reglist 
Rn{!}, reglist 
Rt, [Rn, Rm {, 
LSL #shift}] 
Rt, label 

Rt, [Rn, #offset] 
Rt, (Rn; Rm {; 
LSL #shift}] 
Rt, label 


Clear Exclusive 
Count Leading Zeros 
Compare Negative 
Compare 


Change Processor State, 
Disable Interrupts 


Change Processor State, 
Enable Interrupts 


Data Memory Barrier 


Data Synchronization 
Barrier 


Exclusive OR 


FLDMX (Decrement Before, 
Increment After) loads 


FSTMX (Decrement Before, 
Increment After) stores 


Instruction Synchronization 
Barrier 


If Then condition block 
Load-Acquire Word 
Load-Acquire Byte 


Load-Acquire Exclusive 
Word 


Load-Acquire Exclusive 
Byte 


Load-Acquire Exclusive 
Halfword 


Load-Acquire Halfword 
Load Multiple 


Load Multiple Decrement 
Before 


Load Multiple, Increment 
After 


Load Register Word 
(register offset) 


Load Register Word (literal) 


Load Register Word 
(immediate offset, 
unprivileged) 


N,Z,C,V 
N,Z,C,V 


N,Z,C 


Load Register Byte (register _ 


offset) 


Load Register Byte (literal) 


Section 3.12.12 CLREX 
Section 3.4.4 CLZ 


Section 3.4.5 CMP and CMN 


Section 3.4.5 CMP and CMN 


Section 3.11.2 CPS 


Section 3.11.2 CPS 


Section 3.11.4 DMB 


Section 3.11.5 DSB 


Section 3.4.2 AND, ORR, EOR, 
BIC, and ORN 


Section 3.10.1 FLDMDBX, 
FLDMIAX 


Section 3.10.2 FSTMDBX, 
FSTMIAX 


Section 3.11.6 ISB 


Section 3.9.5 IT 


Section 3.12.9 LDA and STL 


Section 3.12.9 LDA and STL 


Section 3.12.11 LDAEX and 


STLEX 


Section 3.12.11 LDAEX and 


STLEX 


Section 3.12.11 LDAEX and 


STLEX 
Section 3.12.9 LDA and STL 


Section 3.12.6 LDM and STM 


Section 3.12.6 LDM and STM 


Section 3.12.6 LDM and STM 


Section 3.12.3 LDR and STR, 
register offset 
Section 3.12.5 LDR, PC-relative 


Section 3.12.2 LDR and STR, 
immediate offset, Section 
3.12.4 LDR and STR, 
unprivileged 


Section 3.12.3 LDR and STR, 
register offset 


Section 3.12.5 LDR, PC-relative 
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LDRB, LDRBT 


LDRD 


LDRD 


LDREX 


LDREXB 


LDREXH 


LDRH 


LDRH 


LDRH, LDRHT 


LDRSB 


LDRSB 


LDRSB, LDRSBT 


























LDRSH 
LDRSH 

.DRSH, LDRSHT 
‘Si; RSLS 

SR, LSRS 
MLA 
MLS 
MOV, MOVS 

OV, MOVS 

OVT 

OVW 
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Rt, 
Rt, 
# 


Rt; 





Rd, 


Rd, 


Rd, 


Rd, 


Rd, 
Rd, 
Rd, 


Rd, 


[Rn, #offset] 


Rt2, [Rn, 


offset] 


Rt2, label 


[Rn, #offset] 


[Rn] 


[Rn] 


Rn, Rm {, 
shift}] 


label 


Rn, #offset] 


Rn, Rm {, 
shift }] 


label 











Rn, #offset] 


Rn,. Rm {7 
shift}] 


label 








Rn, #offset] 


Rm, <Rs | #n> 


Rm, <Rs | #n> 


Rn, Rm, Ra 


Rn, Rm, Ra 


Op2 
Rm 
#imm1 6 


#imm1 6 


Load Register Byte 
(immediate offset, 
unprivileged) 


Load Register Dual 
(immediate offset) 


Load Register Dual (PC- 
relative) 


Load Register Exclusive 


Load Register Exclusive 
Byte 


Load Register Exclusive 
Halfword 


Load Register Halfword 
(register offset) 


Load Register Halfword 
(literal) 


Load Register Halfword 
(immediate offset, 
unprivileged) 


Load Register Signed Byte 
(register offset) 


Load Register Signed Byte 
(PC-relative) 


Load Register Signed Byte 
(immediate offset, 
unprivileged) 


Load Register Signed 
Halfword (register offset) 


Load Register Signed 
Halfword (PC-relative) 


Load Register Signed 
Halfword (immediate offset, 
unprivileged) 


Logical Shift Left 


Logical Shift Right 


Multiply Accumulate 


Multiply and Subtract 


Move 
Move (register) 
Move Top 


Move 16-bit constant 


N,Z,C 


N,Z,C 


N,Z,C 
N,Z 


N,Z,C 


Section 3.12.2 LDR and STR, 
immediate offset, Section 
3.12.4 LDR and STR, 
unprivileged 


Section 3.12.2 LDR and STR, 
immediate offset 


Section 3.12.5 LDR, PC-relative 


Section 3.12.10 LDREX and 


STREX 


Section 3.12.10 LDREX and 


STREX 


Section 3.12.10 LDREX and 
STREX 


Section 3.12.3 LDR and STR, 
register offset 


Section 3.12.5 LDR, PC-relative 


Section 3.12.2 LDR and STR, 
immediate offset, Section 
3.12.4 LDR and STR, 
unprivileged 


Section 3.12.3 LDR and STR, 
register offset 


Section 3.12.5 LDR, PC-relative 


Section 3.12.2 LDR and STR, 
immediate offset, Section 
3.12.4 LDR and STR, 
unprivileged 


Section 3.12.3 LDR and STR, 
register offset 


Section 3.12.5 LDR, PC-relative 


Section 3.12.2 LDR and STR, 
immediate offset, Section 
3.12.4 LDR and STR, 
unprivileged 


Section 3.4.3 ASR, LSL, LSR, 
ROR, and RRX 


Section 3.4.3 ASR, LSL, LSR, 
ROR, and RRX 


Section 3.5.1 MUL, MLA, and 
MLS 


Section 
MLS 


3.5.1 MUL, MLA, and 


Section 3.4.6 MOV and MVN 


Section 3.4.6 MOV and MVN 
Section 3.4.7 MOVT 


Section 3.4.6 MOV and MVN 
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Move from Special Register 














Rd, spec_reg Section 3.11.7 MRS 
to general register 
Move from general register ' 
SR spec_reg, Rn to Special Register Section 3.11.8 MSR 
UL, MULS (Rd, } Rn, Rm Multiply oe 
MVN, MVNS Rd, Op2 Bitwise NOT N,Z,C Section 3.4.6 MOV and MVN 
NOP - No Operation - Section 3.11.9 NOP 
F Section 3.4.2 AND, ORR, EOR, 
ORN, ORNS Rd, } Rn, Op2 Logical OR NOT N,Z,C BIC, and ORN 
; Section 3.4.2 AND, ORR, EOR, 
ORR, ORRS Rd, } Rn, Op2 Logical OR N.ZC | Bic, and ORN 
Rd, } Rn, Rm, {, Section 3.7.1 PKHBT and 
PKHTB, PKHBT Op2} Pack Halfword - PKHTB 
PLD Rn {, #offset}] Preload Data - Section 3.12.7 PLD 
POP reglist Pop registers from stack - Section 3.12.8 PUSH and POP 
PUSH reglist Push registers onto stack - Section 3.12.8 PUSH and POP 
QADD Rd, } Rn, Rm Saturating Add Q Section 3.6.3 QADD and QSUB 
QADD16 Rd, } Rn, Rm Saturating Add 16 - Section 3.6.3 QADD and QSUB 
QADD8 Rd, } Rn, Rm Saturating Add 8 - Section 3.6.3 QADD and QSUB 


OASX Rd, } Rn, Rm anaes Ree come 2 Section 3.6.4 QASX and QSAX 


Section 3.6.5 QDADD and 


QDADD Rd, } Rn, Rm Saturating Double and Add Q QDSUB 
Saturating Double and Section 3.6.5 QDADD and 
ensue nee een ae Subtract . QDSUB 


QSAX Rd, } Rn, Rm Prien ened and : Section 3.6.4 QASX and QSAX 





QSUB Rd, } Rn, Rm Saturating Subtract Q Section 3.6.3 QADD and QSUB 
QSUB16 Rd, } Rn, Rm Saturating Subtract 16 - Section 3.6.3 QADD and QSUB 
QSUB8 Rd, } Rn, Rm Saturating Subtract 8 - Section 3.6.3 QADD and QSUB 


Section 3.4.8 REV, REV16, 


RBIT Rd, Rn Reverse Bits . REVSH, and RBIT 

Reverse byte order in a Section 3.4.8 REV, REV16, 
REV Rd, Rn word REVSH, and RBIT 

Reverse byte order in each Section 3.4.8 REV, REV16, 
REV16 nea halfword : REVSH, and RBIT 


Revere pe orden ln Section 3.4.8 REV, REV16, 


REVSH Rd, Rn bottom halfword and sign - REVSH, and RBIT 

extend 
ROR, RORS Rd, Rm, <Rs|#n> Rotate Right N,Z,C aa a ea 
RRX, RRXS Rd, Rm Rotate Right with Extend N,Z,C ae ci asad 
RSB, RSBS {Rd, } Rn, Op2 Reverse Subtract Nz | oer et AED Ae, se, 


SBC, and RSB 
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SADD16 


SADD8 


SASX 


SBC, SBCS 


SBFX 


SDIV 
SEL 
SEV 


SG 


SHADD16 


SHADD8 


SHASX 


SHSAX 


SHSUB16 


SHSUB8 


SMLABB, 
SMLABT, 
SMLATB, SMLATT 


SMLAD, SMLADX 














Nnnn 
>> > Db 











n 








> P 





SMLAWB, SMLAWT 


SMLSD, SMLSDX 


SMLSLD, 
SMLSLDX 




















SMMLA, SMMLAR 
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d, ny, 


Rd, } Rn, Rm 


Rd, } Rn, Rm 





Rd, } Rn, Op2 


Rd, Rn, #1lsb, 
width 


Rd, } Rn, Rm 








Rd, } Rn, Rm 


Rd, } Rn, Rm 


Rd, } Rn, Rm 
Rd, } Rn, Rm 
Rd, } Rn, Rm 


Rd, } Rn, Rm 








Rd, } Rn, Rm 


Rd, Rn, Rm, Ra 


Rd, Rn, Rm, Ra 


RdLo, 
Rm 


RdHi, Rn, 


RdLo, 
Rm 


RdHi, Rn, 


RdLo, 
Rm 


RdHi, Rn, 


Rd, Rn, Rm, Ra 


Rd, Rn, Rm, Ra 


RdLo, 
Rm 


RdHi, Rn, 


Rd, Rn, Rm, Ra 


Signed Add 16 


Signed Add 8 


Signed Add and Subtract 
with Exchange 


Subtract with Carry 


Signed Bit Field Extract 


Signed Divide 
Select bytes 
Send Event 


Secure Gateway 


Signed Halving Add 16 


Signed Halving Add 8 

Signed Halving Add and 
Subtract with Exchange 
Signed Halving Subtract 
and Add with Exchange 


Signed Halving Subtract 16 


Signed Halving Subtract 8 


Signed Multiply Accumulate 
halfwords 


Signed Multiply Accumulate 
Dual 


Signed Multiply Accumulate 
Long (32 x 32 + 64), 64-bit 
result 


Signed Multiply Accumulate 
Long, halfwords 


Signed Multiply Accumulate 
Long Dual 


Signed Multiply 
Accumulate, word by 
halfword 


Signed Multiply Subtract 
Dual 


Signed Multiply Subtract 
Long Dual 


Signed Most Significant 
Word Multiply Accumulate 


GE 


GE 


N,Z,C,V 


Section 3.4.9 SADD16 and 
SADD8 


Section 3.4.9 SADD16 and 
SADD8 


Section 3.4.10 SASX and SSAX 


Section 3.4.1 ADD, ADC, SUB, 
SBC, and RSB 


Section 3.8.2 SBFX and UBFX 


Section 3.5.2 SDIV and UDIV 
Section 3.4.11 SEL 
Section 3.11.10 SEV 
Section 3.11.11 SG 


Section 3.4.12 SHADD16 and 
SHADD8 


Section 3.4.12 SHADD16 and 
SHADD8 


Section 3.4.13 SHASX and 
SHSAX 


Section 3.4.13 SHASX and 
SHSAX 


Section 3.4.14 SHSUB16 and 
SHSUB8 


Section 3.4.14 SHSUB16 and 
SHSUB8 


Section 3.5.3 SMLAWB, 
SMLAWT, SMLABB, SMLABT, 
SMLATB, and SMLATT 


Section 3.5.4 SMLAD and 
SMLADX 


Section 3.5.11 UMULL, UMAAL, 
UMLAL, SMULL, and SMLAL 


Section 3.5.5 SMLALD, 
SMLALDX, SMLALBB, SMLALBT, 
SMLALTB, and SMLALTT 


Section 3.5.5 SMLALD, 
SMLALDX, SMLALBB, SMLALBT, 
SMLALTB, and SMLALTT 


Section 3.5.3 SMLAWB, 
SMLAWT, SMLABB, SMLABT, 
SMLATB, and SMLATT 


Section 3.5.6 SMLSD and 
SMLSLD 


Section 3.5.6 SMLSD and 
SMLSLD 


Section 3.5.7 SMMLA and 
SMMLS 
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LS, SMMLSR 


SMMUL, SMMULR 


SMUAD, SMUADX 
SMULBB, 
SMULBT, 


SMULTB, SMULTT 











SMULWB, SMULWT 











SMUSD, SMUSDX 


SSAT 





SSAT16 


SSAX 


SSUB16 


SSUB8 


STL 


STLB 


STLEX 


STLEXB 


STLEXH 





STLH 
STM 


STMDB, STMEA 





STMIA, STMFD 


STR 


STR, STRT 





STRB 


PM0264 - Rev 1 


Rd, Rn, Rm, Ra 


Rd, Rn, Rm 


{Rd, } Rn, Rm 


{Rd, } Rn, Rm 


RdLo, 
Rm 


RdHi, Rn, 


{Rd, } Rn, Rm 


{Rd, } Rn, Rm 


Rd, #n, Rm 
{,shift #s} 


Rd, #n, Rm 
{Rd, } Rn, Rm 
{Rd, } Rn, Rm 


Rn, Rm 


Rt, [Rn 








Rt, [Rn 


Re, Ret. [Rn] 


Rt, Rt [Rn] 


Rt, Rt [Rn] 











Rt, [Rn 

Rn{!}, reglist 
Rn{!}, reglist 
Rn{!}, reglist 
Rt, [Rn, Rm {, 
LSL #shift}] 


Rt, [Rn, #offset] 


Rt, [Rn, Rm {, 
LSL #shift}] 











Signed Most Significant 
Word Multiply Subtract 


Signed Most Significant 
Word Multiply 


Signed Dual Multiply Add 


Signed Multiply (halfwords) 


Signed Multiply Long (32 x 
32), 64-bit result 


Signed Multiply word by 
halfword 


Signed Dual Multiply 
Subtract 


Signed Saturate 


Signed Saturate 16 


Signed Subtract and Add 
with Exchange 


Signed Subtract 16 


Signed Subtract 8 


Store-Release Word 
Store-Release Byte 


Store-Release Exclusive 
Word 


Store-Release Exclusive 
Byte 


Store-Release Exclusive 
Halfword 


Store-Release Halfword 
Store Multiple 


Store Multiple Decrement 
Before 


Store Multiple Increment 
After 


Store Register Word 
(register offset) 


Store Register Word 
(immediate offset, 
unprivileged) 


Store Register Byte 
(register offset) 


GE 


GE 


GE 


Section 3.5.7 SMMLA and 
SMMLS 


Section 3.5.8 SMMUL 


Section 3.5.9 SMUAD and 
SMUSD 


Section 3.5.10 SMUL and 
SMULW 


Section 3.5.11 UMULL, UMAAL, 
UMLAL, SMULL, and SMLAL 


Section 3.5.10 SMUL and 
SMULW 


Section 3.5.9 SMUAD and 
SMUSD 
Section 3.6.1 SSAT and USAT 


Section 3.6.2 SSAT16 and 
USAT16 


Section 3.4.10 SASX and SSAX 


Section 3.4.15 SSUB16 and 
SSUB8 


Section 3.4.15 SSUB16 and 
SSUB8 


Section 3.12.9 LDA and STL 
Section 3.12.9 LDA and STL 


Section 3.12.11 LDAEX and 
STLEX 


Section 3.12.11 LDAEX and 
STIEX 


Section 3.12.11 LDAEX and 
STLEX 


Section 3.12.9 LDA and STL 
Section 3.12.6 LDM and STM 


Section 3.12.6 LDM and STM 


Section 3.12.6 LDM and STM 


Section 3.12.3 LDR and STR, 
register offset 


Section 3.12.2 LDR and STR, 
immediate offset, Section 
3.12.4 LDR and STR, 
unprivileged 


Section 3.12.3 LDR and STR, 
register offset 
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STRB, STRBT 


STRD 


STREX 


STREXB 


STREXH 


STRH 





STRH,; STRHT 


SUB, SUBS 


SUB, SUBW 
SVC 


SXTAB 


SXTAB16 


SXTAH 


SXTB 


SXTB16 





SXTH 


TBB 
TBH 
TEO 


TST 


TTAT 








TTT 


UADD16 


Rd, Rt, 


Rt, [Rn, #offset] 


Rt; Re2,; 
#offset] 


[Rn, 


[Rn, 
#offset] 


Rd, Rt, [Rn] 


Rd, Rt, [Rn] 


Rt, [Rn, Rm {, 
LSL #shift}] 





Rt, [Rn, #offset] 


Rd, } Rn, Op2 


Rd, } Rn, #imm12 
imm 


Rd, } Rn, Rm 
,ROR #n} 


Rd, } Rn, Rm 
,ROR #n} 


Rd,} Rn, Rm 
,ROR #n} 


Rd, Rm {,ROR #n} 


Rd,} Rm {,ROR 
n} 


Rd,} Rm {,ROR 
n} 


Rn, Rm] 














Rn, Rm, LSL #1] 


Rn, Op2 


Rn, Op2 


Rd, [Rn] 


Rd, [Rn] 


Rd, [Rn] 


Rd, [Rn] 


{Rd,} Rn, Rm 


Store Register Byte 
(immediate offset, 
unprivileged) 


Store Register Dual two 
words 


Store Register Exclusive 


Store Register Exclusive 
Byte 


Store Register Exclusive 
Halfword 


Store Register Halfword 
(register offset) 


Store Register Halfword 
(immediate offset, 
unprivileged) 


Subtract 


Subtract 


Supervisor Call 


Sign extend 8 bits to 32 and 


Add 


Sign extend two 8-bit 
values to 16 and Add 


Sign extend 16 bits to 32 
and Add 


Sign extend 8 bits to 32 


Sign extend 8 bits to 16 


Sign extend a Halfword to 


32 

Table Branch Byte 
Table Branch Halfword 
Test Equivalence 


Test 
Test Target 


Test Target Alternate 
Domain 


Test Target Alternate 
Domain Unprivileged 


Test Target Unprivileged 


Unsigned Add 16 


N,Z,C,V 


N,Z,C 
N,Z,C 


GE 


Section 3.12.2 LDR and STR, 
immediate offset, Section 
3.12.4 LDR and STR, 
unprivileged 


Section 3.12.2 LDR and STR, 
immediate offset 


Section 3.12.10 LDREX and 
STREX 


Section 3.12.10 LDREX and 
STREX 


Section 3.12.10 LDREX and 
STREX 


Section 3.12.3 LDR and STR, 
register offset 


Section 3.12.2 LDR and STR, 
immediate offset, Section 
3.12.4 LDR and STR, 
unprivileged 


Section 3.4.1 ADD, ADC, SUB, 
SBC, and RSB 


Section 3.4.1 ADD, ADC, SUB, 
SBC, and RSB 


Section 3.11.12 SVC 


Section 3.7.2 SXTA and UXTA 


Section 3.7.2 SXTA and UXTA 


Section 3.7.2 SXTA and UXTA 
Section 3.7.3 SXT and UXT 


Section 3.7.3 SXT and UXT 


Section 3.7.3 SXT and UXT 


Section 3.9.6 TBB and TBH 
Section 3.9.6 TBB and TBH 
Section 3.4.16 TST and TEQ 
Section 3.4.16 TST and TEQ 


Section 3.11.13 TT, TTT, TTA, 
and TTAT 


Section 3.11.13 TT, TTT, TTA, 
and TTAT 


Section 3.11.13 TT, TTT, TTA, 
and TTAT 


Section 3.11.13 TT, TTT, TTA, 
and TTAT 


Section 3.4.17 UADD16 and 
UADD8& 
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Section 3.4.17 UADD16 and 




















UADD8 Rd, } Rn, Rm Unsigned Add 8 GE UADD8 
UASX Rd,} Rn, Rm Unsigned Add and Subtract | Ge | Section 3.4.18 UASX and USAX 
with Exchange 
R R ak 
UBFX oe See a eey Unsigned Bit Field Extract - Section 3.8.2 SBFX and UBFX 
width 
UDF c}{q} {#}imm Permanently Undefined. - Section 3.11.14 UDF 
UDIV Rd, } Rn, Rm Unsigned Divide - Section 3.5.2 SDIV and UDIV 
F , Section 3.4.19 UHADD16 and 
UHADD16 Rd, } Rn, Rm Unsigned Halving Add 16 - UHADD8 
; : Section 3.4.19 UHADD16 and 

UHADD8 Rd,;} Rn, Rm Unsigned Halving Add 8 - UHADD8 

. Unsigned Halving Add and Section 3.4.20 UHASX and 
oe pee Seen Subtract with Exchange ° UHSAX 

3 Unsigned Halving Subtract Section 3.4.20 UHASX and 
ae Rabe Bn as and Add with Exchange : UHSAX 

‘5 Unsigned Halving Subtract Section 3.4.21 UHSUB16 and 
UHSUB16 Rd, } Rn, Rm 16 - UHSUB8 

a Unsigned Halving Subtract Section 3.4.21 UHSUB16 and 
UHSUB8 Rd, } Rn, Rm 8 - UHSUB8 

Unsigned Multiply 
AAL RdLo, RdHi, Rn, Accumulate Accumulate - Section 3.5.11 UMULL, UMAAL, 

: Rm Long (32 x 32 + 32 + 32), UMLAL, SMULL, and SMLAL 


64-bit result 


Unsigned Multiply 


RdLo, RdHi, Rn, Section 3.5.11 UMULL, UMAAL, 

















UMLAL Accumulate Long (32 x 32 — - 
Rm + 64), 64-bit result UMLAL, SMULL, and SMLAL 
ee RdLo, RdHi, Rn, | Unsigned Multiply Long (32 _ Section 3.5.11 UMULL, UMAAL, 
: i Rm x 32), 64-bit result UMLAL, SMULL, and SMLAL 
Unsigned Saturating Add Section 3.6.7 UQADD and 
UQADD16 Rd, } Rn, Rm 16 - UQSUB 
UQADD8 Rd, } Rn, Rm Unsigned Saturating Add 8 - Seca) 20) UEABE aid 
UQSUB 
Unsigned Saturating Add Section 3.6.6 UQASX and 
a ck ce i a and Subtract with Exchange ~ UQSAX 
Unsigned Saturating : 
UOSAX Rd, } Rn, Rm Subtract and Add with 2 section 32:6 MGha ene 
UQSAX 
Exchange 
Unsigned Saturating Section 3.6.7 UQADD and 
UQSUB16 BT Bay Sn Subtract 16 : UQSUB 
Unsigned Saturating Section 3.6.7 UQADD and 
vOSUES Bee eae Subtract 8 . UQSUB 
USAD8 Rd, } Rn, Rm Unsigned Stntet Absolute) Section 3.4.22 USAD8 
Differences 
Unsigned Sum of Absolute 
USADA8 Rd, Rn, Rm, Ra Differences and - Section 3.4.23 USADA8 
Accumulate 
R Rm hif 
USAT ter eee | ined salina Q Section 3.6.1 SSAT and USAT 





#s},Ra 
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USAT16 


USAX 


USUB16 


USUB8 


UXTAB 


UXTAB16 


UXTAH 


UXTB16 











VABS 


VADD 


VCMP 


VCMPE 


VCVT 


VCVT 





VCVTA 


VCVTB VCV1 





VCVTB VCV1 


VCVTM 
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ny 








ny 








d, n, 
Rd, } Rn, Rm 
Rd, } Rn, Rm 
Rd, } Rn, Rm 
Rd, } Rn, Rm 
,ROR #n} 
Rd, } Rn, Rm 


,ROR #n} 


Rd,} Rn, Rm 
,ROR #n} 


Rd, Rm {,ROR #n} 


Rd,} Rm {,ROR 
n} 








Rd, Rm {,ROR #n} 


-F32 Sd, Sm 


sP32 (Sa, } Sm, 
sm 


.232- Sd; 
#0.0> 


<<Sm| 


,F32 Sd, 
#0.0> 


<<Sm| 


.F32.Tm <Sd>, Sm 


~Ld-F32 Sd; Sa, 
#fbits 


sim: F32 <Sd>,. Sm 


-F32.F16 Sd, Sm 


-F16.F32 Sd, Sm 


sim. F32 <Sd>, Sm 


Unsigned Saturate 16 


Unsigned Subtract and Add 
with Exchange 


Unsigned Subtract 16 


Unsigned Subtract 8 


Rotate, unsigned extend 8 
bits to 32 and Add 


Rotate, unsigned extend 
two 8-bit values to 16 and 
Add 


Rotate, unsigned extend 
and Add Halfword 


Unsigned zero-extend Byte 


Unsigned zero-extend Byte 
16 


Unsigned zero-extend 
Halfword 


Floating-point Absolute 
Floating-point Add 


Compare two floating-point 
registers, or one floating- 
point register and zero 


Compare two floating-point 
registers, or one floating- 
point register and zero with 
Invalid Operation check 


Convert from floating-point 
to integer 


Convert from floating-point 
to fixed point 


Convert from floating-point 
to integer with directed 
rounding to nearest with 
Ties Away 


Convert half-precision value 
to single-precision or 
double-precision 


Convert single-precision or 
double-precision register to 
half-precision 


Convert from floating-point 
to integer with directed 
rounding towards Minus 
infinity 


Q 


GE 


GE 


GE 


N,Z,C,V 


N,Z,C,V 


Section 3.6.2 SSAT16 and 
USAT16 


Section 3.4.18 UASX and USAX 


Section 3.4.24 USUB16 and 
USUB8 


Section 3.4.24 USUB16 and 
USUB8 


Section 3.7.2 SXTA and UXTA 


Section 3.7.2 SXTA and UXTA 


Section 3.7.2 SXTA and UXTA 
Section 3.7.3 SXT and UXT 


Section 3.7.3 SXT and UXT 


Section 3.7.3 SXT and UXT 
Section 3.10.3 VABS 


Section 3.10.4 VADD 


Section 3.10.5 VCMP and 
VCMPE 


Section 3.10.5 VCMP and 
VCMPE 


Section 3.10.6 VCVT and 
VCVTR between floating-point 
and integer 


Section 3.10.7 VCVT between 
floating-point and fixed-point 


Section 3.10.35 VCVTA, VCVTM 
VCVTN, and VCVTP 


Section 3.10.36 VCVTB and 
VCVTT 


Section 3.10.36 VCVTB and 
VCVTT 


Section 3.10.35 VCVTA, VCVTM 
VCVTN, and VCVTP 
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VCVTIN 


VCVTP 


VCVTR 


VDIV 


VEMA 


VFMS 


VENMA 





VENMS 











VLSTM 


VMAXNM 


VMINNM 
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sim. F32 <Sd>,. Sm 


-Tm.F32 <Sd>, Sm 


sTms.F32 <Sd>;, Sm 


.F32 (Sa; }-Snjz 
sm 


sF32 {Sa,} Sm, 
sm 


.F32.{Sda,} Sniy 
Sm 


,F32 (Sa; } Sm, 
Sm 


.F32 {Sd,} Sn, 
sm 





{mode} {.size} 
Rn{!}, list 


-F32 Sd, [<Rn> 
{, #offset}] 


.F32 Sd, <label> 


sE32 ‘Say 
[PC, #-0] 


<c> Rn 


<c> Rn 


»F32 Sd, Sn; Sm 


,F32 Sd, Sn, Sm 


.F32 Sd, Sn; Sm 


,232 Sd, Sn, Sm 


<Sn|/Rt>, <Rt|Sn> 


<Sm|Rt>, <Sm1| 
Rt2>, <Rt|Sm>, 
<Rt2 |Sm1> 


Convert from floating-point 
to integer with directed 
rounding to nearest with 
Ties to even 


Convert from floating-point 
to integer with directed 
rounding towards Plus 
infinity 


Convert between floating- 
point and integer with 
rounding. 


Floating-point Divide 


Floating-point Fused 
Multiply Accumulate 


Floating-point Fused 
Multiply Subtract 


Floating-point Fused 
Negate Multiply Accumulate 


Floating-point Fused 
Negate Multiply Subtract 


Floating-point Load Multiple 
extension registers 


Floating-point Load an 
extension register from 
memory (immediate) 


Load an extension register 
from memory 


Load an extension register 
from memory 


Floating-point Lazy Load 
multiple 


Floating-point Lazy Store 
multiple 


Maximum of two floating- 
point numbers with 
IEEE754-2008 NaN 
handling 


Minimum of two floating- 
point numbers with 
IEEE754-2008 NaN 
handling 


Floating-point Multiply 
Accumulate 


Floating-point Multiply 
Subtract 


Copy core register to 
single-precision 


Copy two core registers to 
two single-precision 


Section 3.10.35 VCVTA, VCVTM 
VCVTN, and VCVTP 


Section 3.10.35 VCVTA, VCVTM 
VCVTN, and VCVTP 


Section 3.10.6 VCVT and 
VCVTR between floating-point 
and integer 


Section 3.10.8 VDIV 


Section 3.10.9 VFMA and VFMS 


Section 3.10.9 VFMA and VFMS 


Section 3.10.10 VFNMA and 
VFNMS 


Section 3.10.10 VFNMA and 
VFNMS 


Section 3.10.11 VLDM 


Section 3.10.12 VLDR 


Section 3.10.12 VLDR 


Section 3.10.12 VLDR 


Section 3.10.13 VLLDM 


Section 3.10.14 VLSTM 


Section 3.10.37 VMAXNM and 
VMINNM 


Section 3.10.37 VMAXNM and 
VMINNM 


Section 3.10.15 VMLA and 
VMLS 


Section 3.10.15 VMLA and 
VMLS 


Section 3.10.19 VMOV core 
register to single-precision 


Section 3.10.20 VMOV two core 
registers to two single-precision 
registers 
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VPOP 


VPUSH 


VRINTA 


VRINTM 


VRINTN 


VRINTP 


VRINTR 
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{.size} Dd[x] 
Rt 


{.dt} Rt, Dn[x] 


-F32 Sd, #immm 


-F32 Sd, Sd, Sm 


<Dm|Rt>, <Rt| 
Rt2>, <Rt2|Dm> 


Rt, FPSCR 


FPSCR, Rt 


-F32 {Sd,} Sn, 
sm 


+#32 Sd, ‘Sm 


2#32 Sd, Sn; Sm 


,232 Sd, Sn; Sm 


sF32° (Sa, } Sn; 
sm 


{.size} list 


{.size} list 


-F32 Sd, Sm 


-F32 Sd, Sm 


sf32 Sd, ‘St 


-F32 Sd, Sm 


~F32 Sd, Sm 


Copy core register to scalar 


Copy scalar to core register 


Floating-point Move 
immediate 


Copies the contents of one 
register to another 


Floating-point Move 
transfers two words 
between two core registers 
and a doubleword register 


Move to core register from 
floating-point Special 
Register 


Move to floating-point 
Special Register from core 
register 


Floating-point Multiply 


Floating-point Negate 


Floating-point Multiply 
Accumulate and Negate 


Floating-point Multiply, 
Subtract and Negate 


Floating-point Multiply and 
Negate 


Load multiple consecutive 
floating-point registers from 
the stack 


Store multiple consecutive 
floating-point registers to 
the stack 


Float to integer in floating- 
point format conversion with 
directed rounding to 
Nearest with Ties Away 


Float to integer in floating- 
point format conversion with 
directed rounding to Minus 
infinity 


Float to integer in floating- 
point format conversion with 
directed rounding to 
Nearest with Ties to even 


Float to integer in floating- 
point format conversion with 
directed rounding to Plus 
infinity 


Float to integer in floating- 
point format conversion with 
rounding towards value 
specified in FPSCR 


N,Z,C,V 


Section 3.10.22 VMOV core 
register to scalar 


Section 3.10.18 VMOV scalar to 
core register 


Section 3.10.16 VMOV 
Immediate 


Section 3.10.17 VMOV Register 


Section 3.10.21 VMOV two core 
registers and a double-precision 
register 


Section 3.10.23 VMRS 


Section 3.10.24 VMSR 


Section 3.10.25 VMUL 


Section 3.10.26 VNEG 


Section 3.10.27 VNMLA, VNMLS 
and VNMUL 


Section 3.10.27 VNMLA, VNMLS 
and VNMUL 


Section 3.10.27 VNMLA, VNMLS 
and VNMUL 


Section 3.10.28 VPOP 


Section 3.10.29 VPUSH 


Section 3.10.39 VRINTA, 
VRINTN, VRINTP, VRINTM, and 
VRINTZ 


Section 3.10.39 VRINTA, 
VRINTN, VRINTP, VRINTM, and 
VRINTZ 


Section 3.10.39 VRINTA, 
VRINTN, VRINTP, VRINTM, and 
VRINTZ 


Section 3.10.39 VRINTA, 
VRINTN, VRINTP, VRINTM, and 
VRINTZ 


Section 3.10.38 VRINTR and 
VRINTX 
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Float to integer in floating- 





point format conversion with _ Section 3.10.38 VRINTR and 
wea Re ec rounding specified in VRINTX 

FPSCR 

Float to integer in floating- Section 3.10.39 VRINTA, 
VRINTZ ,F32 Sd, Sm point format conversion with | - VRINTN, VRINTP, VRINTM, and 

rounding towards Zero VRINTZ 

Select register, alternative 
VSEL -F32° Sd) Sn; Sm to a pair of conditional - Section 3.10.34 VSEL 

VMOV 
VSORT .F32 Sd, Sm aleliones Nentmasnalat Section 3.10.30 VSQRT 


Square Root 


7 {mode} {.size} : , ; ' 
VSTM Rafit, List Floating-point Store Multiple | - Section 3.10.31 VSTM 


Floating-point Store 
-F32 Sd, [Rn{, Register stores an 








went #offset}] extension register to ° meen eeteyee, vate 
memory 
VSUB F32 {Sd,} Sn, Sm _ | Floating-point Subtract - Section 3.10.33 VSUB 
WEE - Wait For Event - Section 3.11.15 WFE 
WEI - Wait For Interrupt - Section 3.11.16 WFI 
YIELD - Suspend task - Section 3.11.17 YIELD 
3.1.1 Binary compatibility with other Cortex processors 


The processor implements the T32 instruction set and features provided by the Armv8-M architecture profile. 
There are restrictions on moving code designed for processors that are implementations of the Armv6-M or 
Armv7-M architectures. 


If code designed for other Cortex-M processors relies on memory protection, it cannot be moved to the 
Cortex-M33 processor. In this case, the memory protection scheme and driver code must be updated from 
PMSAv7 to PMSAv8. 


If code for the Armv7-M processor relies on double-precision-floating point, it cannot be moved to the Cortex-M33 
processor. Any Armv7-M code that uses double-precision arithmetic must be recompiled to use a software library, 
or DP emulation if supported by the tools. 


To ensure a smooth transition, Arm recommends that code designed to operate on other Cortex-M profile 
processor architectures obey the following rules and that you configure the Configuration and Control Register 
(CCR) appropriately: 
° Use word transfers only to access registers in the NVIC and System Control Space (SCS). 
° Treat all unused SCS registers and register fields on the processor as Do-Not-Modify. 
. Configure the following fields in the CCR: 

—  STKALIGN bit to 1. 

— UNALIGN_TRP bit to 1. 

- Leave all other bits in the CCR register at their original value. 


3.2 CMSIS functions 


ISO/IEC C code cannot directly access some Cortex-M33 processor instructions. Instead, intrinsic functions that 
are provided by the CMSIS or a C compiler are used to generate them. If a C compiler does not support an 
appropriate intrinsic function, you might have to use inline assembler to access some instructions. 


3.2.1 List of CMSIS functions to generate some processor instructions 


The CMSIS provides the following intrinsic functions that are provided to generate instructions that ISO/IEC C 
code cannot directly access. 
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Table 30. CMSIS functions to generate some Cortex-M33 processor instructions 


} Instruction | CMSIS function 


BKPT void __BKPT 


REX void __CLREX 











LZ uint8 t  CLZ (uint32 t value) 


PSID I void disable irg(void) 


PSIE F void enable fault irq(void) 





C 
Cc 
CPSID F void disable fault_irq(void) 
Cc 
C 
C 

















































































































PSIE I void enable irq(void) 
DMB void _ DMB(void) 
DSB void _ DSB(void) 
ISB void __ISB(void) 
LDA uint32_t _ LDA (volatile uint32_t * ptr) 
LDAB uint8 t _ LDAB (volatile uint8 t * ptr) 
:DAEX uint32 t _ LDAEX (volatile uint32_t * ptr) 
i\DAEXB uint8 t _ LDAEXB (volatile uint32_ t * ptr) 
i\DAEXH uintl6 t _ LDAEXH (volatile uint32 t * ptr) 
LDAH uint32 t _ LDAH (volatile uint32 t * addr) 
LDRT uint32_t _ LDRT (uint32_t ptr) 
NOP void _ NOP (void) 
RBIT uint32 t — RBIT(uint32 t int value) 
REV uint32 t — REV(uint32 t int value) 
REV16 uint32 t — REV16(uint32 t int value) 
REVSH uint32 t — REVSH(uint32 t int value) 
ROR uint32 t ROR (uint32 t value, uint32 t shift) 
RRX uint32 t — RRX (uint32 t value) 
SEV void SEV (void) 
STL void STL (uint32 t value, volatile uint32 t * ptr) 
STLEX uint32 t — STLEX (uintl6 t value, volatile uint32 t * ptr) 
STLEXB uint32 t | STLEXB (uintl6 t value, volatile uint8 t * ptr) 
STLEXH uint32 t — STLEXH (uintl6 t value, volatile uintl6 t * ptr) 
STLH void  STLH (uint16 t value, volatile uintl6 t * ptr) 
STREX uint32 t | STREXW (uint32 t value, uint32 t *addr) 
STREXB uint32 t _ STREXB (uint8 t value, uint8 t *addr) 
STREXH uint32 t _ STREXH (uintl6 t value, uintl6 t *addr) 
WEE void _ WFE(void) 
WEI void _ WFI (void) 
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3.2.2 CMSE 
CMSE is the compiler support for the Security Extension (architecture intrinsics and options) and is part of the 
Arm C Language (ACLE) specification. 


CMSE features are required when developing software running in Secure state. This provides mechanisms to 
define Secure entry points and enable the tool chain to generate correct instructions or support functions in the 
program image. 


The CMSE features are accessed using various attributes and intrinsics. Additional macros are also defined as 
part of the CMSE. 


3.2.3 CMSIS functions to access the special registers 


List of functions that are provided by the CMSIS for accessing the special registers using MRS and MSR 
instructions. 


Table 31. CMSIS functions to access the special registers 


Special register CMSIS function 



































Read uint32 t _ get _PRIMASK (void) 
PRIMASK 
Write void __set_PRIMASK (uint32 t value) 
Read uint32 t — get _FAULTMASK (void) 
FAULTMASK 
Write void _set_FAULTMASK (uint32_ t value) 
Read uint32 t _ get _BASEPRI (void) 
BASEPRI 
Write void set _BASEPRI (uint32 t value) 
Read uint32 t — get CONTROL (void) 
CONTROL 
Write void __set_CONTROL (uint32 t value) 
Read uint32 t _— get MSP (void) 
MSP 
Write void _set_ MSP (uint32_ t TopOfMainStack) 
Read uint32 t get _PSP (void) 
PSP 
Write void set PSP (uint32_ t TopOfProcStack) 
APSR Read uint32 t get _APSR (void) 
IPSR Read uint32 t _get_IPSR (void) 
xPSR Read uint32 t _get_xPSR (void) 
BASEPRI_MAX Write void set BASEPRI MAX (uint32_t basePri) 
Read uint32 t _get_FPSCR (void) 
FPSCR 
Write void set _FPSCR (uint32 t fpscr) 
Read uint32 t — get _MSPLIM (void) 
MSPLIM 
Write void set _MSPLIM (uint32_ t MainStackPtrLimit) 
Read uint32 t _ get _PSPLIM (void) 
PSPLIM 
Write void set _PSPLIM (uint32_ t ProcStackPtrLimit) 
3.2.4 CMSIS functions to access the Non-secure special registers 


The CMSIS also provides several functions for accessing the Non-secure special registers in Secure state using 
MRS and MSR instructions: 
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Table 32. CMSIS intrinsic functions to access the Non-secure special registers 


Special register CMSIS function 






























































Read uint32_t TZ get PRIMASK NS (void) 
PRIMASK_NS 
Write void TZ set PRIMASK NS (uint32_ t value) 
Read uint32_t TZ get FAULTMASK NS (void) 
FAULTMASK_NS 
Write void TZ set FAULTMASK NS (uint32_ t value) 
Read uint32 t TZ get CONTROL NS (void) 
CONTROL_NS 
Write void TZ set CONTROL NS (uint32 t value) 
Read WINES? te TZ get MSP NS (void) 
MSP_NS 
Write void TZ set MSP_NS (uint32 t TopOfMainStack) 
Read uint32. t TZ get PSP NS (void) 
PSP_NS 
Write void TZ set _PSP_NS (uint32 t TopOfProcStack) 
Read uint32 t TZ get MSPLIM NS (void) 
MSPLIM_NS 
Write void TZ set MSPLIM NS (uint32_t MainStackPtrLimit) 
Read uine32 t TZ get PSPLIM NS (void) 
PSPLIM_NS 
Write void TZ set _PSPLIM NS (uint32_t ProcStackPtrLimit) 
3.3 About the instruction descriptions 


The following sections give more information about using the instructions: 
. Section 3.3.1 Operands 

. Section 3.3.2 Restrictions when using PC or SP 

. Section 3.3.3 Flexible second operand 

. Section 3.3.4 Shift Operations 

. Section 3.3.5 Address alignment 

. Section 3.3.6 PC-relative expressions 

. Section 3.3.7 Conditional execution 

. Section 3.3.8 Instruction width selection 


3.3.1 Operands 


An instruction operand can be an Arm register, a constant, or another instruction-specific parameter. Instructions 
act on the operands and often store the result in a destination register. When there is a destination register in the 
instruction, it is usually specified before the operands. 


Operands in some instructions are flexible in that they can either be a register or a constant. 


3.3.2 Restrictions when using PC or SP 
Many instructions have restrictions on whether you can use the Program Counter (PC) or Stack Pointer (SP) for 
the operands or destination register. See instruction descriptions for more information. 

Note: . For correct operation of B{L}XNS, Rm[0] must be 0 for correct Secure to Non-secure transition. 


° Bit[0] of any address you write to the PC with a BX, BLX, LDM, LDR, or POP instruction must be 1 for correct 
execution, because this bit indicates the required instruction set, and the Cortex-M33 processor only 
supports T32 instructions. 
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3.3.3.1 


Note: 


3.3.3.1.1 


3.3.3.2 


Rm 
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Flexible second operand 

Many general data processing instructions have a flexible second operand. This is shown as Operand2 in the 
descriptions of the syntax of each instruction. 

Operand2 can be: 

. A constant. 

. A register with optional shift. 


Constant 

Instruction form when specifying an Operand2 constant. 

#oonstant 

where constant Can be: 

. Any constant that can be produced by shifting an 8-bit value left by any number of bits within a 32-bit word. 
. Any constant of the form 0x00XYOOXY. 

° Any constant of the form 0xxY00XY00. 

. Any constant of the form 0xXYXYXYXY. 


In these constants, X and Y are hexadecimal digits. 


In addition, in a small number of instructions, constant can take a wider range of values. These are described in 
the individual instruction descriptions. 

When an Operand2 constant is used with the instructions MOVS, MVNS, ANDS, ORRS, ORNS, EORS, BICS, TEQ or 
TST, the carry flag is updated to bit[31] of the constant, if the constant is greater than 255 and can be produced by 
shifting an 8-bit value. These instructions do not affect the carry flag if Operand2 is any other constant. 


Instruction substitution 


Your assembler might be able to produce an equivalent instruction in cases where you specify a constant that is 
not permitted. 


For example, an assembler might assemble the instruction CMP Rd, #OxFFFFFFFE as the equivalent instruction 
CMN Rd, #0x2. 
Register with optional shift 


Instruction form when specifying an Operand2 register. 
Rm{, shift} 
Where: 


Is the register holding the data for the second operand. 
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shift 
Is an optional shift to be applied to Rm. It can be one of: 

ASR #n 

Arithmetic shift right n bits, 1 <n < 32. 
LSL#n 

Logical shift left n bits, 1 <n < 31. 
LSR#n 

Logical shift right n bits, 1 <n 32. 
ROR #n 

Rotate right n bits, 1 <n ¥< 31. 
RRX 


Shift right one bit and insert the carry flag into the most significant bit of the result. 


If omitted, no shift occurs, equivalent to LSL #0. 
If you omit the shift, or specify LSL #0, the instruction uses the value in Rm. 


If you specify a shift, the shift is applied to the value in Rm, and the resulting 32-bit value is used by the 
instruction. However, the contents in the register Rm remain unchanged. Specifying a register with shift also 
updates the carry flag when used with certain instructions. 


3.3.4 Shift Operations 


Register shift operations move the bits in a register left or right by a specified number of bits, the shift length. 
Register shift can be performed: 
° Directly by the instructions ASR, LSR, LSL, ROR, and RRX, and the result is written to a destination register. 


° During the calculation of Operand2 by the instructions that specify the second operand as a register with 
shift. The result is used by the instruction. 


The permitted shift lengths depend on the shift type and the instruction, see the individual instruction description 
or the Flexible second operand. If the shift length is 0, no shift occurs. Register shift operations update the carry 
flag except when the specified shift length is 0. The following sub-sections describe the various shift operations 
and how they affect the carry flag. In these descriptions, Rm is the register containing the value to be shifted, and 
nis the shift length. 


3.3.4.1 ASR 


Arithmetic shift right by n bits moves the left-hand 32-n bits of the register Rm, to the right by n places, into the 
right-hand 32-n bits of the result. And it copies the original bit[31] of the register into the left-hand n bits of the 
result. 

You can use the ASR #n operation to divide the value in the register Rm by 2”, with the result being rounded 
towards negative-infinity. 

When the instruction is ASRS or when ASR #n is used in Operand2 with the instructions MOVS, MVNS, ANDS, 
ORRS, ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to the last bit shifted out, bit[n-1], of the register 
Rm. 


Note: . If n is 32 or more, then all the bits in the result are set to the value of bit[31] of Rm. 
° If n is 32 or more and the carry flag is updated, it is updated to the value of bit[31] of Rm. 
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Figure 13. ASR #3 
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3.3.4.2 LSR 
Logical shift right by n bits moves the left-hand 32-n bits of the register Rm, to the right by n places, into the right- 
hand 32-n bits of the result. And it sets the left-hand n bits of the result to 0. 


You can use the LSR #n operation to divide the value in the register Rm by 2", if the value is regarded as an 
unsigned integer. 

When the instruction is LSRS or when LSR #n is used in Operand2 with the instructions MOVS, MVNS, ANDS, ORRS, 
ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to the last bit shifted out, bit[n-1], of the register Rm. 








Note: ° lf nis 32 or more, then all the bits in the result are cleared to 0. 
. If n is 33 or more and the carry flag is updated, it is updated to 0. 


Figure 14. LSR #3 
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3.3.4.3 LSL 


Logical shift left by n bits moves the right-hand 32-n bits of the register Rm, to the left by n places, into the left- 
hand 32-n bits of the result. And it sets the right-hand n bits of the result to 0. 


You can use the LSL #n operation to multiply the value in the register Rm by 2”, if the value is regarded as an 
unsigned integer or a two’s complement signed integer. Overflow can occur without warning. 

When the instruction is LSLS or when LSL #n, with non-zero n, is used in Operand2 with the instructions MOVs, 
MVNS, ANDS, ORRS, ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to the last bit shifted out, bit[32-n], 
of the register Rm. These instructions do not affect the carry flag when used with LSL #0. 








Note: . If n is 32 or more, then all the bits in the result are cleared to 0. 
. If n is 33 or more and the carry flag is updated, it is updated to 0. 
Figure 15. LSL #3 
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3.3.4.4 ROR 
Rotate right by n bits moves the left-hand 32-n bits of the register Rm, to the right by n places, into the right-hand 
32-n bits of the result. And it moves the right-hand rn bits of the register into the left-hand n bits of the result. 


When the instruction is RORS or when ROR #n is used in Operand2 with the instructions MOVS, MVNS, ANDS, 
ORRS, ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to the last bit rotation, bit[n-1], of the register Rm. 
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Note: . If n is 32, then the value of the result is same as the value in Rm, and if the carry flag is updated, it is 
updated to bit[31] of Rm. 


. ROR with shift length, n, more than 32 is the same as ROR with shift length n-32. 


Figure 16. ROR #3 
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3.3.4.5 RRX 
Rotate right with extend moves the bits of the register Rm to the right by one bit. And it copies the carry flag into 
bit[31] of the result. 


When the instruction is RRXS or when RRX is used in Operand2 with the instructions MOVS, MVNS, ANDS, ORRS, 
ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to bit[0] of the register Rm. 








Figure 17. RRX 























3.3.5 Address alignment 
An aligned access is an operation where a word-aligned address is used for a word, dual word, or multiple word 
access, or where a halfword-aligned address is used for a halfword access. Byte accesses are always aligned. 
The Cortex-M33 processor supports unaligned access only for the following instructions: 
° LDR, LDRT. 
° ,DRH, LDRHT. 
° ,DRSH, LDRSHT. 
. STR, STRT. 
° STRH, STRHT. 




















All other load and store instructions generate a UsageFault exception if they perform an unaligned access, and 
therefore their accesses must be address aligned. 


Unaligned accesses are usually slower than aligned accesses. In addition, some memory regions might not 
support unaligned accesses. Therefore, Arm recommends that programmers ensure that accesses are aligned. 
To trap accidental generation of unaligned accesses, use the UNALIGN_TRP bit in the Configuration and Control 
Register. 


3.3.6 PC-relative expressions 


A PC--relative expression or /abel is a symbol that represents the address of an instruction or literal data. It is 
represented in the instruction as the PC value plus or minus a numeric offset. The assembler calculates the 
required offset from the label and the address of the current instruction. If the offset is too big, the assembler 
produces an error. 


Note: ° For B, BL, CBNZ, and CBZ instructions, the value of the PC is the address of the current instruction plus 4 
bytes. 


° For all other instructions that use labels, the value of the PC is the address of the current instruction plus 4 
bytes, with bit[1] of the result cleared to 0 to make it word-aligned. 


. Your assembler might permit other syntaxes for PC-relative expressions, such as a label plus or minus a 
number, or an expression of the form [PC, #number]. 
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3.3.7 Conditional execution 


Most data processing instructions can optionally update the condition flags in the Application Program Status 
Register (APSR) according to the result of the operation. Some instructions update all flags, and some only 
update a subset. If a flag is not updated, the original value is preserved. See the instruction descriptions for the 
flags they affect. 


You can execute an instruction conditionally, based on the condition flags set in another instruction, either: 
° Immediately after the instruction that updated the flags. 

° After any number of intervening instructions that have not updated the flags. 

Conditional execution is available by using conditional branches or by adding condition code suffixes to 


instructions. The condition code suffix enables the processor to test a condition based on the flags. If the 
condition test of a conditional instruction fails, the instruction: 


Fi Does not execute. 

° Does not write any value to its destination register. 

° Does not affect any of the flags. 

° Does not generate any exception. 

Conditional instructions, except for conditional branches, must be inside an If-Then instruction block. Depending 
on the vendor, the assembler might automatically insert an IT instruction if you have conditional instructions 
outside the IT block. 

Use the CBZ and CBNz instructions to compare the value of a register against zero and branch on the result. 


ER WY elf The condition flags 
The APSR contains the N, Z, C, and V condition flags. 


N Set to 1 when the result of the operation was negative, cleared to 0 otherwise. 
Z Set to 1 when the result of the operation was zero, cleared to 0 otherwise. 

Cc Set to 1 when the operation resulted in a carry, cleared to 0 otherwise. 

V Set to 1 when the operation caused overflow, cleared to 0 otherwise. 


For more information about APSR, see Section 2.1.3.6.1 Application Program Status Register 

The C condition flag is set in one of four ways: 

. For an addition, including the comparison instruction CMN, C is set to 1 if the addition produced a carry (that 
is, an unsigned overflow), and to 0 otherwise. 

° For a subtraction, including the comparison instruction CMP, C is set to 0 if the subtraction produced a 
borrow (that is, an unsigned underflow), and to 1 otherwise. 


. For non-addition or subtractions that incorporate a shift operation, C is set to the last bit shifted out of the 
value by the shifter. 


° For other non-addition or subtractions, C is normally left unchanged. See the individual instruction 
descriptions for any special cases. 

Overflow occurs when the sign of the result, in bit{31], does not match the sign of the result had the operation 

been performed at infinite precision. For example, the V condition flag can be set in one of four ways: 

° If adding two negative values results in a positive value. 

° If adding two positive values results in a negative value. 

° If subtracting a positive value from a negative value generates a positive value. 

° If subtracting a negative value from a positive value generates a negative value. 


The Compare operations are identical to subtracting, for CMP, or adding, for CMN, except that the result is 
discarded. See the instruction descriptions for more information. 


Note: Most instructions update the status flags only if the S suffix is specified. See the instruction descriptions for more 
information. 
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BP Per ey’ Condition code suffixes 


The instructions that can be conditional have an optional condition code, shown in syntax descriptions as {cona}. 
Conditional execution requires a preceding IT instruction. An instruction with a condition code is only executed if 
the condition code flags in the APSR meet the specified condition. 


You can use conditional execution with the IT instruction to reduce the number of branch instructions in code. 
The following table also shows the relationship between condition code suffixes and the N, Z, C, and V flags. 


Table 33. Condition code suffixes 


a 

















EQ Z=1 Equal. 
NE Z=0 Not equal. 
CS or HS C=1 Higher or same, unsigned. 
CC or LO C=0 Lower, unsigned. 
MI N=1 Negative. 
PL N=0 Positive or zero. 
VS V=1 Overflow. 
VC V=0 No overflow. 
HI C=1andZ=0 Higher, unsigned. 
LS C=0orZ=1 Lower or same, unsigned. 
GE N=V Greater than or equal, signed. 
17 N!=V Less than, signed. 
GT Z=OandN=V Greater than, signed. 
E Z=1andN!=V Less than or equal, signed. 
AL Can have any value Always. This is the default when no suffix is specified. 








The following example shows the use of a conditional instruction to find the absolute value of a number. RO = 


abs(R1). 
Absolute value MOVS ROME ; RO = R1, setting flags. 
valu MI ; Skipping next instruction if value 0 or positive. 
RSBMI RO, RO, #0 ; If negative, RO = -RO. 


The following example shows the use of conditional instructions to update the value of R4 if the signed values RO 
is greater than R1 and R2 is greater than R3. 


Compare and update value cyp RO, R1 ; Compare RO and R1, setting flags. 
iTesTay GT ; Skip next two instructions uniless GT condition holds. 
CMPGT Re, IRS) ; If 'greater than', compare R2 and R3, setting flags. 
MOVGT R4, R5 list iii egreaver than, Goh s— RS), 

3.3.8 Instruction width selection 


There are many instructions that can generate either a 16-bit encoding or a 32-bit encoding depending on the 
operands and destination register specified. For some of these instructions, you can force a specific instruction 
size by using an instruction width suffix. The .W suffix forces a 32-bit instruction encoding. The .N suffix forces a 
16-bit instruction encoding. 
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If you specify an instruction width suffix and the assembler cannot generate an instruction encoding of the 
requested width, it generates an error. 


In some cases it might be necessary to specify the .W suffix, for example if the operand is the label of an 
instruction or literal data, as in the case of branch instructions. This is because the assembler might not 
automatically generate the right size encoding. 


To use an instruction width suffix, place it immediately after the instruction mnemonic and condition code, if any. 
The following example shows instructions with the instruction width suffix. 


7 Ureates a 32-bit instruction even for a short: branch. 
ADDS.W RO, RO, Rl ; Creates a 32-bit instruction even though the same 
7 Operation Gan be cone by 2a L6-5Le instruction, 


General data processing instructions 


Table 34 shows the data processing instructions: 


Table 34. Data processing instructions 





Add with Carry Section 3.4.1 ADD, ADC, SUB, SBC, and RSB 
ADD Add Section 3.4.1 ADD, ADC, SUB, SBC, and RSB 
ADDW Add Section 3.4.1 ADD, ADC, SUB, SBC, and RSB 
AND Logical AND Section 3.4.2 AND, ORR, EOR, BIC, and ORN 
ASR Arithmetic Shift Right Section 3.4.3 ASR, LSL, LSR, ROR, and RRX 
BIC Bit Clear Section 3.4.2 AND, ORR, EOR, BIC, and ORN 
CLZ Count leading zeros Section 3.4.4 CLZ 
CMN Compare Negative Section 3.4.5 CMP and CMN 
CMP Compare Section 3.4.5 CMP and CMN 
EOR Exclusive OR Section 3.4.2 AND, ORR, EOR, BIC, and ORN 
LSL Logical Shift Left Section 3.4.3 ASR, LSL, LSR, ROR, and RRX 
LSR Logical Shift Right Section 3.4.3 ASR, LSL, LSR, ROR, and RRX 
MOV Move Section 3.4.6 MOV and MVN 
MOVT Move Top Section 3.4.7 MOVT 
MOVW Move 16-bit constant Section 3.4.6 MOV and MVN 
MVN Move NOT Section 3.4.6 MOV and MVN 
ORN Logical OR NOT Section 3.4.2 AND, ORR, EOR, BIC, and ORN 
ORR Logical OR Section 3.4.2 AND, ORR, EOR, BIC, and ORN 
RBIT Reverse Bits Section 3.4.8 REV, REV16, REVSH, and RBIT 
REV Reverse byte order in a word Section 3.4.8 REV, REV16, REVSH, and RBIT 
REV16 Reverse byte order in each halfword Section 3.4.8 REV, REV16, REVSH, and RBIT 
REVSH Reverse byte order in bottom halfword and sign extend Section 3.4.8 REV, REV16, REVSH, and RBIT 
ROR Rotate Right Section 3.4.3 ASR, LSL, LSR, ROR, and RRX 
RRX Rotate Right with Extend Section 3.4.3 ASR, LSL, LSR, ROR, and RRX 
RSB Reverse Subtract Section 3.4.1 ADD, ADC, SUB, SBC, and RSB 
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SADD16 Signed Add 16 Section 3.4.9 SADD16 and SADD8 
SADD8 Signed Add 8 Section 3.4.9 SADD16 and SADD8 
SASX Signed Add and Subtract with Exchange Section 3.4.10 SASX and SSAX 
SEL Select bytes Section 3.4.11 SEL 
SSAX Signed Subtract and Add with Exchange Section 3.4.10 SASX and SSAX 
SBC Subtract with Carry Section 3.4.1 ADD, ADC, SUB, SBC, and RSB 
SHADD16 | Signed Halving Add 16 Section 3.4.12 SHADD16 and SHADD8& 
SHADD8 Signed Halving Add 8 Section 3.4.12 SHADD16 and SHADD8& 
SHASX Signed Halving Add and Subtract with Exchange Section 3.4.13 SHASX and SHSAX 
SHSAX Signed Halving Subtract and Add with Exchange Section 3.4.13 SHASX and SHSAX 
SHSUB16 | Signed Halving Subtract 16 Section 3.4.14 SHSUB16 and SHSUB8 
SHSUB8 Signed Halving Subtract 8 Section 3.4.14 SHSUB16 and SHSUB8 
SSUB16 Signed Subtract 16 Section 3.4.15 SSUB16 and SSUB8 
SSUB8 Signed Subtract 8 Section 3.4.15 SSUB16 and SSUB8& 
SUB Subtract Section 3.4.1 ADD, ADC, SUB, SBC, and RSB 
SUBW Subtract Section 3.4.1 ADD, ADC, SUB, SBC, and RSB 
TEQ Test Equivalence Section 3.4.16 TST and TEQ 
TST Test Section 3.4.16 TST and TEQ 
UADD16 Unsigned Add 16 Section 3.4.17 UADD16 and UADD8& 
UADD8 Unsigned Add 8 Section 3.4.17 UADD16 and UADD8& 
UASX Unsigned Add and Subtract with Exchange Section 3.4.18 UASX and USAX 
USAX Unsigned Subtract and Add with Exchange Section 3.4.18 UASX and USAX 
UHADD16 | Unsigned Halving Add 16 Section 3.4.19 UHADD16 and UHADD8& 
UHADD8 Unsigned Halving Add 8 Section 3.4.19 UHADD16 and UHADD8& 
UHASX Unsigned Halving Add and Subtract with Exchange Section 3.4.20 UHASX and UHSAX 
UHSAX Unsigned Halving Subtract and Add with Exchange Section 3.4.20 UHASX and UHSAX 
UHSUB16 | Unsigned Halving Subtract 16 Section 3.4.21 UHSUB16 and UHSUB8 
UHSUB8 Unsigned Halving Subtract 8 Section 3.4.21 UHSUB16 and UHSUB8 
USAD8 Unsigned Sum of Absolute Differences Section 3.4.22 USAD8& 
USADA8 Unsigned Sum of Absolute Differences and Accumulate Section 3.4.23 USADA8 
USUB16 Unsigned Subtract 16 Section 3.4.24 USUB16 and USUB8 
USUB8 Unsigned Subtract 8 Section 3.4.24 USUB16 and USUB8 
3.4.1 ADD, ADC, SUB, SBC, and RSB 


Add, Add with carry, Subtract, Subtract with carry, and Reverse Subtract. 


op{S}{ cond} {Rd,} Rn, Operand2 ; ADD; ADC; SBC; RSB 
op{S|W} cond} {Rd,} Rn, #imm12 ; ADD; SUB 
Where: 
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Is one of: 


Add with Carry. 
SUB 

Subtract. 

SBC 

Subtract with Carry. 
RSB 


Reverse Subtract. 


Ss 
Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation. 
cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the register holding the first operand. 
Operand2 
Is a flexible second operand. 
imm12 
Is any value in the range 0-4095. 
Operation 
The ADD instruction adds the value of Operand2 or imm72 to the value in Rn. 
The ADC instruction adds the values in Rn and Operand2, together with the carry flag. 
The SUB instruction subtracts the value of Operand2 or imm12 from the value in Rn. 
The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is clear, the result is 
reduced by one. 
The RSB instruction subtracts the value in Rn from the value of Operand2. This is useful because of the wide 
range of options for Operand2. 
Use ADC and SBC to synthesize multiword arithmetic. 
Note: ADDwW is equivalent to the ADD syntax that uses the imm12 operand. SUBW is equivalent to the SUB syntax that 


uses the imm12 operand. 


Restrictions 


In these instructions: 
° Operand2 must not be SP and must not be PC. 
° Rd can be SP only in ADD and SUB, and only with the additional restrictions: 
—  Rnmust also be SP. 
— Any shift in Operand2 must be limited to a maximum of 3 bits using LSL. 
° Rn can be SP only in ADD and SUB. 
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° Rd can be PC only in the ADD{ cond} PC, PC, Rminstruction where: 
— You must not specify the S suffix. 
- Rm must not be PC and must not be SP. 
- If the instruction is conditional, it must be the last instruction in the IT block. 


° with the exception of the ADD{ cond} PC, PC, Rminstruction, Rn can be PC only in ADD and SUB, and 
only with the additional restrictions: 


— You must not specify the S suffix. 
— The second operand must be a constant in the range 0-4095. 

Note: - When using the PC for an addition or a subtraction, bits[1:0] of the PC are rounded to 00 before performing 
the calculation, making the base address for the calculation word-aligned. 


— If you want to generate the address of an instruction, you have to adjust the constant based on the value of 
the PC. Arm recommends that you use the ADR instruction instead of ADD or SUB with Rn equal to the PC, 
because your assembler automatically calculates the correct constant for the ADR instruction. 


When Rdis PC in the ADD{ cond} PC, PC, Rminstruction: 
° Bit[0] of the value written to the PC is ignored. 
° A branch occurs to the address created by forcing bit[0] of that value to 0. 


Condition flags 


If S is specified, these instructions update the N, Z, C and V flags according to the result. 


ADD R2, Ril, RS 
SUBS R8, R6, #240 Sets the flags on the result. 
RSB R4, R4, #1280 Subtracts contents of R4 from 1280. 


ADCHI Ril, RO, Ra Only executed if C flag set and @. 


tilaig clear: 


Se Ne se 


Multiword arithmetic examples 


The following example shows two instructions that add a 64-bit integer contained in R2 and R3 to another 64-bit 
integer contained in RO and R1, and place the result in R4 and R5. 


64-bit addition ADDS R4, RO, R2 ; Add the least significant words. 
ADC 15), JeMIL,, TES) 7; Add the most significant words with carry. 


Multiword values do not have to use consecutive registers. The following example shows instructions that subtract 
a 96-bit integer contained in RY, R1, and R11 from another contained in R6, R2, and R8. The example stores the 
result in R6, RY, and R2. 


96-bit subtraction SUBS R6, R6, RY ; Subtract the least significant words. 

SBCS RG), IRL, IRul 7 Subtract the middle words with carry. 

SBC ve U8ele URL + Subtract the most significant words with carry. 
3.4.2 AND, ORR, EOR, BIC, and ORN 


Logical AND, OR, Exclusive OR, Bit Clear, and OR NOT. 


op{S}{ cond} {Rd,} Rn, Operand2 
Where: 
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op 
Is one of: 
AND 


Logical AND. 

ORR 

Logical OR, or bit set. 
EOR 


Logical Exclusive OR. 


BIC 
Logical AND NOT, or bit clear. 
ORN 
Logical OR NOT. 
S 
Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation. 
cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the register holding the first operand. 
Operand2 


Is a flexible second operand. 


Operation 


The AND, EOR, and ORR instructions perform bitwise AND, Exclusive OR, and OR operations on the values in Rn 
and Operand2. 


The BIC instruction performs an AND operation on the bits in Rn with the complements of the corresponding bits 
in the value of Operand2. 


The ORN instruction performs an OR operation on the bits in Rn with the complements of the corresponding bits in 
the value of Operand2. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


If S is specified, these instructions: 

. Update the N and Z flags according to the result. 

° Can update the C flag during the calculation of Operand2. 
. Do not affect the V flag. 


AND R9, R2, #0xFFOO 
ORREQ 12, IR), IRS) 

ANDS RG Tee RIGimetHOscin9 

EORS R7, R11, #0x18181818 
isIE RO, R1, #0xab 

ORN R7, Rll, R14, ROR #4 
ORNS ig, iilil, wal“l. iNSik sesy2 
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3.4.3 ASR, LSL, LSR, ROR, and RRX 
Arithmetic Shift Right, Logical Shift Left, Logical Shift Right, Rotate Right, and Rotate Right with Extend. 
op{S}{cona} Rd, Rm, Rs 


op{SK{ cond} Rd, Rm, #n 
RRX{S}{ cond} Rd, Rm 


Where: 
op 
Is one of: 
ASR 
Arithmetic Shift Right. 
LSL 
Logical Shift Left. 
LSR 
Logical Shift Right. 
ROR 
Rotate Right. 
S 
Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation. 
Rd 
Is the destination register. 
Rm 
Is the register holding the value to be shifted. 
Rs 
Is the register holding the shift length to apply to the value in Rm. Only the least significant byte is used and can 
be in the range 0-255. 
n 
Is the shift length. The range of shift length depends on the instruction: 
ASR 
Shift length from 1 to 32 
LSL 
Shift length from 0 to 31 
LSR 
Shift length from 1 to 32 
ROR 


Shift length from 1 to 31. 


Note: MOVS Rd, Rmis the preferred syntax for LSLS Rd, Rm, #0. 


Operation 

ASR, LSL, LSR, and ROR move the bits in the register Rm to the left or right by the number of places specified by 
constant n or register Rs. 

RRX moves the bits in register Rm to the right by 1. 


In all these instructions, the result is written to Rd, but the value in register Rm remains unchanged. For details on 
what result is generated by the different instructions. 
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3.4.4 


cond 


Rd 


Rm 


3.4.5 


cond 


Rn 
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Restrictions 


Do not use SP and do not 


Condition flags 


If S is specified: 


use PC. 


° These instructions update the N, Z and C flags according to the result. 
. The C flag is updated to the last bit shifted out, except when the shift length is 0. 


ASR R7, R8, #9 
LSLS Rie ets 
LSR R4, R5, #6 
ROR R4, R5, R6 
RRX R4, R5 





Ne Ne Ne se Ne 


CLZ 


Count Leading Zeros. 


CLZ{cond} Rd, Rm 
Where: 


Arithmetic shift right by 9 bits. 
liegical shitt lett by 3 bits with flag update. 
hogpeal suite Eight by 6 bits. 


Rotate right by the value in the bottom byte of R6. 





Rotate right with extend. 


Is an optional condition code. 


Is the destination register. 


Is the operand register. 


Operation 


The CLZ instruction counts the number of leading zeros in the value in Rm and returns the result in Rd. The result 
value is 32 if no bits are set and zero if bit[31] is set. 


Restrictions 


Do not use SP and do not 


Condition flags 


use PC. 


This instruction does not change the flags. 


CLZ R4,R9 
CLZNE eS) 





CMP and CMN 


Compare and Compare Negative. 


CMP{conad} Rn, Operand2 
CMN{conad} Rn, Operand2 
Where: 


Is an optional condition code. 


Is the register holding the 


first operand. 
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Operand2 


Is a flexible second operand. 


Operation 
These instructions compare the value in a register with Operand2. They update the condition flags on the result, 
but do not write the result to a register. 


The cMP instruction subtracts the value of Operand2 from the value in Rn. This is the same as a SUBS 
instruction, except that the result is discarded. 


The CMN instruction adds the value of Operand2 to the value in Rn. This is the same as an ADDs instruction, 
except that the result is discarded. 


Restrictions 


In these instructions: 
° Do not use PC. 
° Operand2 must not be SP. 


Condition flags 


These instructions update the N, Z, C and V flags according to the result. 


CMP R2, R9 
CMN RO, #6400 
CMPGT S2, IRF, WS, 72 


3.4.6 MOV and MVN 
Move and Move NOT. 


MOV{S}{conad} Rd, Operand2 
MOV{S}{cona} Rd, Rm 
MOV{W}{cond} Rd, #imm16 
MVN{S}{cond} Rd, Operand2 
Where: 


Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation. 
cond 
Is an optional condition code. 
Rd 
Is the destination register. 
Operand2 
Is a flexible second operand. 
Rm 
The source register. 
imm16 


Is any value in the range 0-65535. 


Operation 


The MOV instruction copies the value of Operand2 into Rd. 

When Operand2 in a MOV instruction is a register with a shift other than LSL #0, the preferred syntax is the 
corresponding shift instruction:Also, the Mov instruction permits additional forms of Operand2 as synonyms for 
shift instructions: 
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° ASR{S}{cond} Rd, Rm, #nis the preferred syntax for MOV{S}{cond} Rd, Rm, ASR #n. 

° LSL{S}{cond} Rd, Rm, #nis the preferred syntax for MOV{S}{cond} Rd, Rm, LSL #nifn!=0. 
° LSR{S}{cond} Rd, Rm, #nis the preferred syntax for MOV{S}{cond} Rd, Rm, LSR #n. 

° ROR{S}{cond} Rd, Rm, #nis the preferred syntax for MOV{S}{cond} Rd, Rm, ROR #n. 

. RRX{S}{cond} Rd, Rmis the preferred syntax for MOV{S}{cond} Rd, Rm, RRX. 








° MOV{S}{cond} Rd, Rm, ASR RsiS asynonym for ASR{S}{cond} Rd, Rm, Rs. 
° MOV{S}{cond} Rd, Rm, LSL Rsis asynonym for LSL{S}{cond} Rd, Rm, Rs. 
: MOV{S}{cond} Rd, Rm, LSR RsiS asynonym for LSR{S}{cond} Rd, Rm, Rs. 
° MOV{S}{cond} Rd, Rm, ROR Rsis asynonym for ROR{S}{cond} Rd, Rm, Rs. 























The MVN instruction takes the value of Operand2, performs a bitwise logical NOT operation on the value, and 
places the result into Rd. 


Note: The MOvw instruction provides the same function as MOV, but is restricted to using the imm16 operand. 


Restrictions 


You can use SP and PC only in the Mov instruction, with the following restrictions: 
° The second operand must be a register without shift. 
. You must not specify the s suffix. 


When Rd is PC in a MOV instruction: 
. Bit[0] of the value written to the PC is ignored. 
. A branch occurs to the address created by forcing bit[0] of that value to 0. 


Note: Though it is possible to use MOV as a branch instruction, Arm strongly recommends the use of a BX or BLX 
instruction to branch for software portability to the Arm instruction set. 


Condition flags 


If S is specified, these instructions: 

° Update the N and Z flags according to the result. 

° Can update the C flag during the calculation of Operand2. 
° Do not affect the V flag. 


MOVS R11, #0x000B 
MOV R1, #0xFAO5 
MOVS R10, R12 

MOV R3, #23 

MOV R8, SP 

MVNS R2, #0xF 


Write value of 0x000B to R11, flags get updated. 
Write value of OxFA05 to Rl, flags are not updated. 
Write value in R12 to R10, flags get updated. 

Write value of 23 to R3. 

Write value of stack pointer to R8. 

Write value of OxFFFFFFFO (bitwise inverse of OxF). 
to the R2 and update flags. 


See en en an nT) 


3.4.7 MOVT 
Move Top. 


MOVT{cond} Rd, #imm16 


Where: 
cond 
Is an optional condition code. 
Rd 
Is the destination register. 
imm16 


Is a 16-bit immediate constant and must be in the range 0-65535. 
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3.4.8 


op 


REV 


Operation 


MOVT writes a 16-bit immediate value, imm76, to the top halfword, Ra[31:16], of its destination register. The write 
does not affect Ra[15:0]. 


The MOV, MOVT instruction pair enables you to generate any 32-bit constant. 
Restrictions 


Rd must not be SP and must not be PC. 


Condition flags 


This instruction does not change the flags. 


MOVT R3, #0xF123 ; Write OxF123 to upper halfword of R3, lower halfword 
7 and APSR are unchanged. 


REV, REV16, REVSH, and RBIT 
Reverse bytes and Reverse bits. 


op{cond} Rd, Rn 
Where: 


Is one of: 


Reverse byte order in a word. 


REV16 


Reverse byte order in each halfword independently. 


REVSH 


Reverse byte order in the bottom halfword, and sign extend to 32 bits. 


RBIT 


Reverse the bit order in a 32-bit word. 


cond 


Rd 


Rn 


REV16 


PM0264 - Rev 1 


Is an optional condition code. 


Is the destination register. 


Is the register holding the operand. 


Operation 


Use these instructions to change endianness of data: 


converts either: 
° 32-bit big-endian data into little-endian data. 
° 32-bit little-endian data into big-endian data. 


converts either: 
° 16-bit big-endian data into little-endian data. 
° 16-bit little-endian data into big-endian data. 
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REVSH converts either: 
. 16-bit signed big-endian data into 32-bit signed little-endian data. 
. 16-bit signed little-endian data into 32-bit signed big-endian data. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not change the flags. 


REV RB, RT 
REV16 RO, RO 
REVSH RO, R5 
REVHS R3, R7 
RBIT R7, R8 


Reverse byte order of value in R/ and write it to R3. 
Reverse byte order of each 16-bit halfword in RO. 

Reverse Signed Halfword. 

Reverse with Higher or Same condition. 

Reverse bilt order of value in R8 and write the result to R/7. 


Ne Ne Ne te Ne 


3.4.9 SADD16 and SADD8 
Signed Add 16 and Signed Add 8. 


op{cond} {Rd,} Rn, Rm 
Where: 
op 
Is one of: 
SADD16 
Performs two 16-bit signed integer additions. 
SADD8 


Performs four 8-bit signed integer additions. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 


Is the second operand register. 


Operation 


Use these instructions to perform a halfword or byte add in parallel. 

The SADD16 instruction: The SADD8 instruction: 

1. Adds each halfword from the first operand to the corresponding halfword of the second operand. 
2. Writes the result in the corresponding halfwords of the destination register. 

1. Adds each byte of the first operand to the corresponding byte of the second operand. 

2. Writes the result in the corresponding bytes of the destination register. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions set the APSR.GE bits according to the results of the additions. 
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For SADD16: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Snail = Saline Ushal| sis Os)) ap Siliajs (Reni) <i) 3 Os)) 9 
Sum2) —sSilne (Ra Sl G> eS Draite (RY [im] Sale G >) 
Rife is 0= es suml< PS) 10. 
R[d]<31:16> = sum2<15:0>; 
APSR.GE<1:0> = if suml >= 0 then '11' else '00'; 
APSR.GE<3:2> = if sum2 >= 0 then '11' else '00'; 





For SADD8: 


if ConditionPassed() then 
EncodingSpecificOperations (); 

Sind = Sine (Rall <7sOS)) sp Sivoe CR limi| <7 3 OS) p 
sum2 Sihioe (lial SUS oss) ap Silos (Rimi) <3 Ss) p 
sums! = Sint(R[n|/<23316>) + Sint (R'[m]<23)3; 16>); 
sum4 = SInt(R[n]<31:24>) + SInt(R[m]<31:24>); 

Ria 0>s—s sum. 0 = 

R[d]<15:8> = sum2<7:0>; 

Rich <23si16S = swmsi<7 30s 

R[d]<31:24> = sum4<7:0>; 

APSR.GE<0O> = if suml >= 0 then '1' else '0'; 
APSR.GE<1> = if sum2 >= 0 then '1' else '0'; 
APSR.GE<2> = if sum3 >= 0 then '1' else '0'; 
APSR.GE<3> = if sum4 >= 0 then '1' else '0'; 





SADDILG Ri, RO 7; Adds the halfwords in RO to the corresponding halfwords of 
7 Ril and writes to corresponding halfword of RI-SADDS R4, RO, RS 
7 Adds bytes of RO to the corresponding byte in R5 and writes 
7 to the corresponding byte in R4. 


3.4.10 SASX and SSAX 
Signed Add and Subtract with Exchange and Signed Subtract and Add with Exchange. 


op{cond} {Rd,} Rn, Rm 


Where: 
op 
Is one of: 
SASX 
Signed Add and Subtract with Exchange. 
SSAX 


Signed Subtract and Add with Exchange. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 


Is the second operand register. 


Operation 


The SASxX instruction: 
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Adds the signed top halfword of the first operand with the signed bottom halfword of the second operand. 
Writes the signed result of the addition to the top halfword of the destination register. 


Subtracts the signed bottom halfword of the second operand from the top signed halfword of the first 
operand. 


Writes the signed result of the subtraction to the bottom halfword of the destination register. 


The SSAx instruction: 


oe 


2. 
3. 
4. 


Subtracts the signed bottom halfword of the second operand from the top signed halfword of the first 
operand. 


Writes the signed result of the addition to the bottom halfword of the destination register. 
Adds the signed top halfword of the first operand with the signed bottom halfword of the second operand. 
Writes the signed result of the subtraction to the top halfword of the destination register. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions set the APSR.GE bits according to the results. 
For SASX: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Gli = Sins ORlhal| Sass) = Scie CR liunl] <Sil eiLGs)) p 
sum — Sime (Rial) si e>\ Sine (Rimi) <5) 0>)i- 
Bla) <Ls¢0> = det 15s0rs 
R[d]<31:16> = sum<15:0>; 


APSR.GE<1:0> 


if ditt >= 0! then "11" else "00"; 


APSR.GE<3:2> = if sum >= 0 then '11' else '00'; 


For SSAX: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Su = Sine (emilee) Sint ie) <3 ei 
lites = Satine (Rin Sil silGs)) = Satine (x |hanil| <iLS sss) 2 


Rael ket O ees anor O)e> re 

RICGI<KMlsilos = Clre<cilS 90S 
BPSR.GE<120> 
APSR.GEH<3:2> 


if sum >= 0 then '11' else '00'; 
ibe Sclikeke > — SON theny iN velses OO; 





SASX TRO), TRV, TENS) ; Adds top halfword of R4 to bottom halfword of R5 and 


; writes to top halfword of RO. 
; Subtracts bottom halfword of R5 from top halfword of R4 
7 and writes to bottom halfword of RO. 


SSAX Ry, IRB, Ie 7; SUbteracts top haltword of RZ Erom bottom halitword of BR2 


3.4.11 SEL 


7 and writes to bottom halfword of R7. 
; Adds top halfword of R3 with bottom halfword of R2 and 
7 WEltes to top haliword of Ri. 


Select bytes. Selects each byte of its result from either its first operand or its second operand, according to the 
values of the GE flags. 


SEL{cond} {Rd,} Rn, Rm 
Where: 


cond 


Is an optional condition code. 
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Rn 


Rm 


3.4.12 


op 


SHADD16 


Is the destination register. If Rd is omitted, the destination register is Rn. 


Is the first operand register. 


Is the second operand register. 


Operation 


The SEL instruction: 
1. Reads the value of each bit of APSR.GE. 


2. Depending on the value of APSR.GE, assigns the destination register the value of either the first or second 
operand register. 


The behavior is: 


if ConditionPassed() then 
EncodingSpecificOperations (); 


R[d]<7:0> = if APSR.GE<0O> == '1' then R[n]<7:0> else R[m]<7:0>; 
R[d]<15:8> = if APSR.GE<1> == '1' then R[n]<15:8> else R[m]<15:8>; 
R[d]<23:16> = if APSR.GE<2> == '1' then R[n]<23:16> else R[m]<23:16>; 
R[d]<31:24> = if APSR.GE<3> == '1' then R[n]<31:24> else R[m]<31:24>; 


Restrictions 


None. 


Condition flags 


These instructions do not change the flags. 


SADD16 RO, R1, R2 ; Set GE bits based on result. 
SEL RO, RO, R3 7 Select bytes from RO or R3, based on GE. 
SHADD16 and SHADD8 


Signed Halving Add 16 and Signed Halving Add 8. 


op{cond} {Rd,} Rn, Rm 
Where: 


Is one of: 


Signed Halving Add 16. 


SHADD8 


Signed Halving Add 8. 


cond 


Rd 


Rn 


Rm 
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Is an optional condition code. 


Is the destination register. If Rd is omitted, the destination register is Rn. 


Is the first operand register. 


Is the second operand register. 
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3.4.13 


op 


SHASX 


Operation 

Use these instructions to add 16-bit and 8-bit data and then to halve the result before writing the result to the 
destination register. 

The SHADD16 instruction: The SHADD8 instruction: 

Adds each halfword from the first operand to the corresponding halfword of the second operand. 
Shuffles the result by one bit to the right, halving the data. 

Writes the halfword results in the destination register. 

Adds each byte of the first operand to the corresponding byte of the second operand. 

Shuffles the result by one bit to the right, halving the data. 

Writes the byte results in the destination register. 


CINE So (Ni 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not change the flags. 


SHADDI6 RI, RO ; Adds halfwords in RO to corresponding halfword of Rl and 
7 writes halved result to corresponding halfword in Rl. 
SHADD8 R4, RO, R5 ; Adds bytes of RO to corresponding byte in R5 and 
7 writes halved result to corresponding byte in R4. 


SHASX and SHSAX 
Signed Halving Add and Subtract with Exchange and Signed Halving Subtract and Add with Exchange. 


op{cond} {Rd,} Rn, Rm 
Where: 


Is one of: 


Add and Subtract with Exchange and Halving. 


SHSAX 


Subtract and Add with Exchange and Halving. 


cond 


Rd 


Rn 


Rm 
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Is an optional condition code. 


Is the destination register. If Rd is omitted, the destination register is Rn. 


Is the first operand register. 


Is the second operand register. 


Operation 


The SHASxX instruction: 
1. Adds the top halfword of the first operand with the bottom halfword of the second operand. 


2. Writes the halfword result of the addition to the top halfword of the destination register, shifted by one bit to 
the right causing a divide by two, or halving. 


3. | Subtracts the top halfword of the second operand from the bottom highword of the first operand. 
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4. Writes the halfword result of the division in the bottom halfword of the destination register, shifted by one bit 
to the right causing a divide by two, or halving. 


The SHSAxX instruction: 
1. Subtracts the bottom halfword of the second operand from the top highword of the first operand. 


2. Writes the halfword result of the addition to the bottom halfword of the destination register, shifted by one bit 
to the right causing a divide by two, or halving. 


Adds the bottom halfword of the first operand with the top halfword of the second operand. 


Writes the halfword result of the division in the top halfword of the destination register, shifted by one bit to 
the right causing a divide by two, or halving. 


700 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the condition code flags. 


SHASX Ry, IRL Ee) Adds top halfword of R4 to bottom halfword of R2 

and writes halved result to top halfword of R/. 
Subtracts top halfword of R2 from bottom halfword of 
R4 and writes halved result to bottom halfword of R7. 
Subtracts bottom halfword of R5 from top halfword 

of R3 and writes halved result to top halfword of RO. 
Adds top halfword of RS to bottom halfword of R3 and 
writes halved result to bottom halfword of RO. 


SHSAX IO), IRS) IRS) 


Sree ne ee en a nr) 


3.4.14 SHSUB16 and SHSUB8 
Signed Halving Subtract 16 and Signed Halving Subtract 8. 


op{cond} {Rd,} Rn, Rm 
Where: 
op 
Is one of: 
SHSUB16 
Signed Halving Subtract 16. 
SHSUB8 


Signed Halving Subtract 8. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 


Is the second operand register. 


Operation 

Use these instructions to add 16-bit and 8-bit data and then to halve the result before writing the result to the 
destination register. 

The SHSUB16 instruction: The SHSUBB8 instruction: 

1. Subtracts each halfword of the second operand from the corresponding halfwords of the first operand. 
2.  Shuffles the result by one bit to the right, halving the data. 
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Writes the halved halfword results in the destination register. 

Subtracts each byte of the second operand from the corresponding byte of the first operand. 
Shuffles the result by one bit to the right, halving the data. 

Writes the corresponding signed byte results in the destination register. 


Oe SO 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not change the flags. 


SHSUB16 R1, RO ; Subtracts halfwords in RO from corresponding halfword 
of Rl and writes to corresponding halfword of Rl. 
Subtracts bytes of RO from corresponding byte in R5, 
and writes to corresponding byte in R4. 


SHSUB8 R4, RO, RS 


al Sa) Sed 


3.4.15 SSUB16 and SSUB8 
Signed Subtract 16 and Signed Subtract 8. 


op{cond} {Rd,} Rn, Rm 
Where: 
op 
Is one of: 
SSUB16 
Performs two 16-bit signed integer subtractions. 
SSUB8 


Performs four 8-bit signed integer subtractions. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 


Is the second operand register. 


Operation 


Use these instructions to change endianness of data. 

The SSUB16 instruction: The SSUB8 instruction: 

1. | Subtracts each halfword from the second operand from the corresponding halfword of the first operand. 

2 Writes the difference result of two signed halfwords in the corresponding halfword of the destination register. 
1. | Subtracts each byte of the second operand from the corresponding byte of the first operand. 

2 Writes the difference result of four signed bytes in the corresponding byte of the destination register. 


Restrictions 
Do not use SP and do not use PC. 
Condition flags 


These instructions set the APSR.GE bits according to the results of the subtractions. 
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For SSUB16: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Clbel = SinaeGRfial<l 530s) = Site OR hanl| <i ss) p 
Glen = Sina (Rial <Sil3 LSS) = Scie (uRlial| <Silg iL Gs) p 
RCl|<S30s = chiseei<il'5 9 0sp 
RIClI]| <Sikg lGs = Clie eis eOesp 


APSR.GE<1;0> = if difttl >= 0 then '11" elise "00'; 
APSR.GE<3;3;2> = 1f diftt2 >= 0 then '11" elise "00'; 


For SSUB8: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Ciel = Sine CRfia|<7sOS) = Sains UR] <7 eOs)) e 
Clie? = Sinae CR&fia|<iSsss)) = Sitiote (R|lmn]| ils ees) e 
Glabitié S} SuLias (R|fia|| KPIs LSS) = SicMe CR] <2 39 iLGS)) e 
diff4 = SInt(R[n]<31:24>) - SInt(R[m]<31:24>); 
Riclii<7#sOs = Chiisrik<7/ 30S 
Ri ClI|K<LS BS = Chisie2<7/ eOese 
R[d]<23:16> CblBEeS<7/ 20S 
R[d]<31:24> = diff4<7:0>; 
APSR.GE<0O> = if diffl >= 0 then '1' else '0'; 
APSR.GE<1> = if diff2 >= 0 then '1' else '0'; 
APSR.GE<2> = if diff3 >= 0 then '1' else '0'; 


APSR.GE<3> = if diff4 >= 0 then '1' else '0'; 


SSUB16 R1, RO ; Subtracts halfwords in RO from corresponding halfword of R1 
7 and writes to corresponding halfword of R1. 

SSUB8 R4, RO, RO 7; Subtracts bytes of Ro from corresponding byte an 
7; RO, and writes to corresponding byte of R4. 


3.4.16 TST and TEQ 


Test bits and Test Equivalence. 


TST{cond} Rn, Operand2 
TEQ{cond} Rn, Operand2 





Where: 
cond 
Is an optional condition code. 
Rn 
Is the first operand register. 
Operand2 


Is a flexible second operand. 


Operation 


These instructions test the value in a register against Operand2. They update the condition flags based on the 
result, but do not write the result to a register. 

The TST instruction performs a bitwise AND operation on the value in Rn and the value of Operand2. This is the 
same as the ANDs instruction, except that it discards the result. 

To test whether a bit of Rn is 0 or 1, use the TST instruction with an Operand2 constant that has that bit set to 1 
and all other bits cleared to 0. 

The TEQ instruction performs a bitwise Exclusive OR operation on the value in Rn and the value of Operand2. 
This is the same as the EORS instruction, except that it discards the result. 
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Use the TEQ instruction to test if two values are equal without affecting the V or C flags. 


TEQ is also useful for testing the sign of a value. After the comparison, the N flag is the logical Exclusive OR of the 
sign bits of the two operands. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions: 

. Update the N and Z flags according to the result. 

° Can update the C flag during the calculation of Operand2, 
. Do not affect the V flag. 


HE SuE RO, #0x3F8 ; Perform bitwise AND of RO value to 0x3F8, 


7 APSR is updated but result is discarded 
TEOQEO RIO, BRS 7; Conditionally test 2£ value in Ri0 is equal to 
7 value in RY, APSR is updated but result is discarded. 


3.4.17 UADD16 and UADD8 
Unsigned Add 16 and Unsigned Add 8. 


op{cond} {Rd,} Rn, Rm 
Where: 
op 
Is one of: 
UADD16 
Performs two 16-bit unsigned integer additions. 
UADD8 


Performs four 8-bit unsigned integer additions. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 


Is the second operand register. 


Operation 


Use these instructions to add 16- and 8-bit unsigned data. 

The UADD16 instruction: 

1. Adds each halfword from the first operand to the corresponding halfword of the second operand. 
2. Writes the unsigned result in the corresponding halfwords of the destination register. 

The UADD8 instruction: 

1. Adds each byte of the first operand to the corresponding byte of the second operand. 

2. Writes the unsigned result in the corresponding byte of the destination register. 


Restrictions 


Do not use SP and do not use PC. 
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Condition flags 


These instructions set the APSR.GE bits according to the results of the additions. 
For UADD16: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Seal = Wikies UR fal| Sig OS)) ap Wikis (CRimn|| <i gOS) p 
sum2 = UInt (R[n]<31:16>) + UInt (R[m]<31:16>); 
Riiali<ts0> —ssumili<Si0e 
R[d]<31:16> = sum2<15:0>; 
APSR.GE<1:0> = if suml >= 0x10000 then '11' else '00'; 
APSR.GE<3:2> = if sum2 >= 0x10000 then '11' else '00'; 





For UADD8: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Sendi = Wikioe (Usiall<7eWS)) ap Wikis (UR nl|s< 7 SOs) e 


Sume Ufa (Ril) See) Uae (Rim | are )e- 
sum3 = UInt (R[n]<23:16>) + UInt (R[m]<23:16>) ; 
sum4 = UInt (R[n]<31:24>) + UInt(R[m]<31:24>); 


R[d]<7:0> = suml1<7:0>; 

R[d]<15:8> = sum2<7:0>; 

R[d]<23:16> = sum3<7:0>; 

R[d]<31:24> = sum4<7:0>; 

APSR.GE<0O> = if suml >= 0x100 then '1' else '0'; 
APSR.GE<1> = if sum2 >= 0x100 then '1' else '0'; 
APSR.GE<2> = if sum3 >= 0x100 then '1' else '0'; 
APSR.GE<3> = if sum4 >= 0x100 then '1' else '0'; 





UADD16 R1, RO ; Adds halfwords in RO to corresponding halfword of R1, 
7 writes to corresponding halfword of R1. 

UADD8 R4, RO, R5 ; Adds bytes of RO to corresponding byte in R5 and writes 
7; to corresponding byte in R4. 


3.4.18 UASX and USAX 
Unsigned Add and Subtract with Exchange and Unsigned Subtract and Add with Exchange. 


op{cond} {Rd,} Rn, Rm 


Where: 
op 
Is one of: 
UASX 
Add and Subtract with Exchange. 
USAX 


Subtract and Add with Exchange. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 


Is the second operand register. 
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Operation 


The UASxX instruction: 

1. | Subtracts the top halfword of the second operand from the bottom halfword of the first operand. 
2. Writes the unsigned result from the subtraction to the bottom halfword of the destination register. 
3. Adds the top halfword of the first operand with the bottom halfword of the second operand. 

4. Writes the unsigned result of the addition to the top halfword of the destination register. 

The USAxX instruction: 

1. Adds the bottom halfword of the first operand with the top halfword of the second operand. 

2. Writes the unsigned result of the addition to the bottom halfword of the destination register. 

3.  Subtracts the bottom halfword of the second operand from the top halfword of the first operand. 
4. Writes the unsigned result from the subtraction to the top halfword of the destination register. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions set the APSR.GE bits according to the results. 
For UASX: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Clit = line (Rn <LSsOs) = Waninie (IR \lual|<siil gil 5s)) 2 
Sod = Wiitinne (15 |[o| <suil SiLGss)) 4p iWilhione (ix ifinl| <ilS 90s) 5 
RCCL gOS S Chiseie<ils) 2 0)>¢ 
R[d]<31:16> = sum<15:0>; 
APSR.GE<1:0> if diff >= 0 then '11' else '00'; 
APSR.GE<3:2> = if sum >= 0x10000 then '11' else '00'; 


For USAX: 


if ConditionPassed() then 
EncodingSpecificOperations (); 
Soin = Wikre (nl <LS SOs) 4b Wihove (Ilhan eS Sal s3)) 2 
Clie = Wie GR] <Sil Sis) = Wihote (1X |linl| <5) 3 OS) ¢ 
RICWHKULSsOS = soim<il Se Ws- 
IR Cll| <sal salts = Clabeie<ilS\s O35 
APSR.GE<1:0> = if sum >= 0x10000 then '11' else '00'; 
APSR.GE<3:2> = if diff >= 0 then '11' else '00'; 


UASX ROP RA RS! 7 Adds top halfword of R4 to bottom halfiword of RS and 
7 writes to top halfword of RO. 
7 SubEeracts bottom haltword of RS trom top Maliword of 0 
7 ane Writes to bottom hal tword of RU. 

USAX Rip IRB, Ie , SuUpERectSs top Naliword of R2 From porto nalinord of Ro 
7 and writes to bottom halfword of R7. 
7 JOS cop Mal tword of (Ro co isoLecom Nealiverd of Re and 
7 WEECSS tO top Naliword of Ri. 


3.4.19 UHADD16 and UHADD8 
Unsigned Halving Add 16 and Unsigned Halving Add 8. 


op{cond} {Rd,} Rn, Rm 
Where: 
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op 
Is one of: 
UHADD16 
Unsigned Halving Add 16. 
UHADD8 
Unsigned Halving Add 8. 
cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the register holding the first operand. 
Rm 
Is the register holding the second operand. 
Operation 
Use these instructions to add 16- and 8-bit data and then to halve the result before writing the result to the 
destination register. 
The UHADD16 instruction: 
1. Adds each halfword from the first operand to the corresponding halfword of the second operand. 
2.  Shuffles the halfword result by one bit to the right, halving the data. 
3. Writes the unsigned results to the corresponding halfword in the destination register. 
The UHADD8 instruction: 
1. Adds each byte of the first operand to the corresponding byte of the second operand. 
2.  Shuffles the byte result by one bit to the right, halving the data. 
3. Writes the unsigned results in the corresponding byte in the destination register. 
Restrictions 
Do not use SP and do not use PC. 
Condition flags 
These instructions do not change the flags. 
UHADDIG6 RY, R3 7; Adds halfwords in R7? to corresponding halfword of R3 
7 and writes halved result to corresponding halfword in R7. 
UHADD8 R4, RO, RS ; Adds bytes of RO to corresponding byte in R5 and writes 
7 halved result to corresponding byte in R4. 
3.4.20 UHASX and UHSAX 


Unsigned Halving Add and Subtract with Exchange and Unsigned Halving Subtract and Add with Exchange. 


op{cond} {Rd,} Rn, Rm 
Where: 
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op 

Is one of: 
UHASX 
Unsigned Halving Add and Subtract with Exchange. 
UHSAX 
Unsigned Halving Subtract and Add with Exchange. 
cond 

Is an optional condition code. 
Rd 

Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 

Is the first operand register. 
Rm 


Is the second operand register. 


Operation 


The UHASx instruction: 

Adds the top halfword of the first operand with the bottom halfword of the second operand. 
Shifts the result by one bit to the right causing a divide by two, or halving. 

Writes the halfword result of the addition to the top halfword of the destination register. 
Subtracts the top halfword of the second operand from the bottom halfword of the first operand. 
Shifts the result by one bit to the right causing a divide by two, or halving. 

Writes the halfword result of the subtraction in the bottom halfword of the destination register. 
The UHSAX instruction: 


oo PON > 


Subtracts the bottom halfword of the second operand from the top halfword of the first operand. 
Shifts the result by one bit to the right causing a divide by two, or halving. 

Writes the halfword result of the subtraction in the top halfword of the destination register. 

Adds the bottom halfword of the first operand with the top halfword of the second operand. 
Shifts the result by one bit to the right causing a divide by two, or halving. 

Writes the halfword result of the addition to the bottom halfword of the destination register. 


oa RWN > 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the condition code flags. 


UHASX Rp, Uv, Ie ; Adds top halfword of R4 with bottom halfword of R2 
and writes halved result to top halfword of R7. 
SupEracus top Naliword of Re Erom sotcom Naliword (oF 
R?7 and writes halved result to bottom halfword of R7. 
Subtracts bottom halfword of R5 from top halfword of 
R3 and writes halved result to top halfword of RO. 
Adds top halfword of RS to bottom halfword of R3 and 
writes halved result to bottom halfword of RO. 


UHSAX IR), ISI IRS) 


Ne Ne Ne Ne Ne Ne Ne 


3.4.21 UHSUB16 and UHSUB8 
Unsigned Halving Subtract 16 and Unsigned Halving Subtract 8. 


op{cond} {Rd,} Rn, Rm 
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Where: 
op 
Is one of: 
UHSUB16 
Performs two unsigned 16-bit integer subtractions, halves the results, and writes the results to the destination register. 
UHSUB8 


Performs four unsigned 8-bit integer subtractions, halves the results, and writes the results to the destination register. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 
Is the second operand register. 
Operation 
Use these instructions to add 16-bit and 8-bit data and then to halve the result before writing the result to the 
destination register. 
The UHSUB16 instruction: 
1. Subtracts each halfword of the second operand from the corresponding halfword of the first operand. 
2.  Shuffles each halfword result to the right by one bit, halving the data. 
3. | Writes each unsigned halfword result to the corresponding halfwords in the destination register. 
The UHSUB8 instruction: 
1. | Subtracts each byte of second operand from the corresponding byte of the first operand. 
2.  Shuffles each byte result by one bit to the right, halving the data. 
3. Writes the unsigned byte results to the corresponding byte of the destination register. 
Restrictions 
Do not use SP and do not use PC. 
Condition flags 
These instructions do not change the flags. 
UHSUB16 Ri, RO ; Subtracts halfwords in RO from corresponding halfword of 
7; Rl and writes halved result to corresponding halfword in 
B JRL 
UHSUB8 R4, RO, R5 7 Subtracts bytes of R5 from corresponding byte in RO and 
7 writes halved result to corresponding byte in R4. 
3.4.22 USAD8 
Unsigned Sum of Absolute Differences. 
USAD8{cona} {Rd,} Rn, Rm 
Where: 
cond 
Is an optional condition code. 
Rd 


Is the destination register. If Rd is omitted, the destination register is Rn. 
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Rn 
Is the first operand register. 
Rm 
Is the second operand register. 
Operation 
The USAD8 instruction: 
1. Subtracts each byte of the second operand register from the corresponding byte of the first operand register. 
2. Adds the absolute values of the differences together. 
3. Writes the result to the destination register. 
Restrictions 
Do not use SP and do not use PC. 
Condition flags 
These instructions do not change the flags. 
USAD8 R1, R4, RO ; Subtracts each byte in RO from corresponding byte of R4 
7; adds the differences and writes to Rl. 
USAD8 RO, RS 7 Subtracts bytes Of Ro Erom corresponding byte an RO; 
7; adds the differences and writes to RO. 
3.4.23 USADA8 
Unsigned Sum of Absolute Differences and Accumulate. 
USADA8{cond} Rd, Rn, Rm, Ra 
Where: 
cond 
Is an optional condition code. 
Rd 
Is the destination register. 
Rn 
Is the first operand register. 
Rm 
Is the second operand register. 
Ra 


Is the register that contains the accumulation value. 


Operation 


The USADAS instruction: 

1. | Subtracts each byte of the second operand register from the corresponding byte of the first operand register. 
2. Adds the unsigned absolute differences together. 

3. Adds the accumulation value to the sum of the absolute differences. 

4 Writes the result to the destination register. 


Restrictions 


Do not use SP and do not use PC. 
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Condition flags 


These instructions do not change the flags. 


USADA8 R1, RO, R6 Subtracts bytes in RO from corresponding halfword of R1 
adds differences, adds value of R6, writes to R1. 
Subtracts bytes of R5 from corresponding byte in RO 


adds differences, adds value of R2 writes to R4. 


USADA8 R4, RO, R5, R2 


Se ye se 


3.4.24 USUB16 and USUB8 
Unsigned Subtract 16 and Unsigned Subtract 8. 


op{cond} {Rd,} Rn, Rm 


Where: 
op 
Is one of: 
USUB16 
Unsigned Subtract 16. 
USUB8 


Unsigned Subtract 8. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 


Is the second operand register. 


Operation 


Use these instructions to subtract 16-bit and 8-bit data before writing the result to the destination register. 
The USUB16 instruction: 


1. | Subtracts each halfword from the second operand register from the corresponding halfword of the first 
operand register. 


2. Writes the unsigned result in the corresponding halfwords of the destination register. 

The USUB8 instruction: 

1. | Subtracts each byte of the second operand register from the corresponding byte of the first operand register. 
2. Writes the unsigned byte result in the corresponding byte of the destination register. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions set the APSR.GE bits according to the results of the subtractions. 
For USUB16: 
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if ConditionPassed() then 
EncodingSpecificOperations (); 


Gliseeil = Witinte (RLS gOS) = Witine (Ax |hmil| <ilS sss) 2 
lisse? = Willie (Rp RSal eis) — Wparine (is |fial| << Shik SLs) 2 
RICHI CLSsWs > chizeeil<ilsS 302 
RC Ks giles = Clisee2<ilS 20\¢ 
APSR.GE<1:0> = if diffl >= 0 then '11' else '00'; 
APSR.GE<3:2> = if diff2 >= 0 then '11' else '00'; 
For USUB8: 
if ConditionPassed() then 
EncodingSpecificOperations(); 
Chel = Wine (Rll <i SOs) = Wubate (x |inl|<7 SOS) - 
diff2 = UInt(R[n]<15:8>) - UInt(R[m]<15:8>); 
Cliiies) = Wibote (Ro QZs owes) = Wine (Ian 233 15>) ¢ 
diff4 = UInt(R[n]<31:24>) - UInt(R[m]<31:24>); 
R[d]<7:0> = diff1<7:0>; 
ULC CIS Btsis= = Chiire2<7/ S0se 
INCH GAS sites: = Clbiecsk<7/ SOs- 
IRC; gan e Babs: Clabreck<7/ Sse 
APSR.GE<0> = if diffl >= then '1' else '0'; 
APSR.GE<1> = if diff2 >= 0 then '1' else '0'; 
APSR.GE<2> = if diff3 >= 0 then '1' else '0'; 
APSR.GE<3> = if diff4 >= 0 then '1' else '0'; 
USUB16 R1, RO 7 Subtracts halfwords in RO from corresponding halfword of Ri 
7 and writes to corresponding halfword in Rl. 
USUBS R4, RO, RS ; Subtracts bytes of RS from corresponding byte in RO and 


7 writes to the corresponding byte in R4. 


3.5 Multiply and divide instructions 


Table 35 shows the multiply and divide instructions: 


Table 35. Multiply and divide instructions 


2| ele 
a 


SMLA[B,T] 


SMLAD, SMLADX 


SMLAL 





SMLAL[B,T] 








SMLA 





SMLAW[B|T] 


SMLSD 











SMLSLD 
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iD, SMLALDX 


Multiply with Accumulate, 32-bit result 
Multiply and Subtract, 32-bit result 
Multiply, 32-bit result 

Signed Divide 


Signed Multiply Accumulate (halfwords) 


Signed Multiply Accumulate Dual 


Signed Multiply with Accumulate (32 x 32 + 64), 
64-bit result 


Signed Multiply Accumulate Long (halfwords) 


Signed Multiply Accumulate Long Dual 


Signed Multiply Accumulate (word by halfword) 


Signed Multiply Subtract Dual 


Signed Multiply Subtract Long Dual 


Section 3.5.1 MUL, MLA, and MLS 
Section 3.5.1 MUL, MLA, and MLS 
Section 3.5.1 MUL, MLA, and MLS 
Section 3.5.2 SDIV and UDIV 


Section 3.5.3 SMLAWB, SMLAWT, SMLABB, 
SMLABT, SMLATB, and SMLATT 


Section 3.5.4 SMLAD and SMLADX 


Section 3.5.11 UMULL, UMAAL, UMLAL, SMULL, 
and SMLAL 


Section 3.5.5 SMLALD, SMLALDX, SMLALBB, 
SMLALBT, SMLALTB, and SMLALTT 


Section 3.5.5 SMLALD, SMLALDX, SMLALBB, 
SMLALBT, SMLALTB, and SMLALTT 


Section 3.5.3 SMLAWB, SMLAWT, SMLABB, 
SMLABT, SMLATB, and SMLATT 


Section 3.5.6 SMLSD and SMLSLD 
Section 3.5.6 SMLSD and SMLSLD 
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SMMLA Signed Most Significant Word Multiply Accumulate Section 3.5.7 SMMLA and SMMLS 
SMMLS, SMMLSR Signed Most Significant Word Multiply Subtract Section 3.5.7 SMMLA and SMMLS 
































SMMUL, SMMULR Signed Most Significant Word Multiply Section 3.5.8 SMMUL 
SMUAD, SMUADX Signed Dual Multiply Add Section 3.5.9 SMUAD and SMUSD 
SMUL[B,T] Signed Multiply (word by halfword) Section 3.5.10 SMUL and SMULW 
SMULL Signed Multiply (32 x 32), 64-bit result oe a eee err nea 
SMULWB, SMULWT | Signed Multiply (word by halfword) Section 3.5.10 SMUL and SMULW 
SMUSDX ,SMUSD Signed Dual Multiply Subtract Section 3.5.9 SMUAD and SMUSD 
UDIV Unsigned Divide Section 3.5.2 SDIV and UDIV 
UMAAL Unsigned Multiply Accumulate Accumulate Long | Section 3.5.11 UMULL, UMAAL, UMLAL, SMULL, 
(32 x 32 + 32 + 32), 64-bit result and SMLAL 
UMLAL Unsigned Multiply with Accumulate (32 x 32 + 64), | Section 3.5.11 UMULL, UMAAL, UMLAL, SMULL, 
64-bit result and SMLAL 
UMULL Unsigned Multiply (32 x 32), 64-bit result i AD eee Ermey ee 
3.5.1 MUL, MLA, and MLS 
Multiply, Multiply with Accumulate, and Multiply with Subtract, using 32-bit operands, and producing a 32-bit 
result. 


MUL{S}{cond} {Rd,} Rn, Rm; Multiply 
MLA{cond} Rd, Rn, Rm, Ra ; Multiply with accumulate 
MLS{cond} Rd, Rn, Rm, Ra ; Multiply with subtract 





Where: 

cond 

Is an optional condition code. 
S 

Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation. 
Rd 

Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn, Rm 

Are registers holding the values to be multiplied. 
Ra 


Is a register holding the value to be added or subtracted from. 


Operation 


The MUL instruction multiplies the values from Rn and Rm, and places the least significant 32 bits of the result in 
Rd. 


The MLA instruction multiplies the values from Rn and Rm, adds the value from Ra, and places the least 
significant 32 bits of the result in Rd. 


The MLS instruction multiplies the values from Rn and Rm, subtracts the product from the value from Ra, and 
places the least significant 32 bits of the result in Rd. 


The results of these instructions do not depend on whether the operands are signed or unsigned. 





Restrictions 


In these instructions, do not use SP and do not use PC. 
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If you use the S suffix with the MUL instruction: 

° Rd, Rn, and Rm must all be in the range RO-R7. 
. Rd must be the same as Rm. 

. You must not use the cond suffix. 


Condition flags 


The MLA instruction and MULS instructions: 
. Only MULS instruction updates the N and Z flags according to the result. 
. No other MUL, MLA, or MLS instruction affects the condition flags. 


MUL LO), IRB, IRS) 7 Multiply, R10 = R2 x R5 

MLA Ri0, Re, Ri, RS 7 Multiply with accumulate, Ri0i = {R2 x Ri} + RS 
MULS ROP Re ee ; Multiply with flag update, RO = R2 x R2 

MULLT IVE ISI IVE ; Conditionally multiply, R2 = R3 x R2 

MLS R4, RS, RG, KR? 7 Multiply with subtract, R4 = R? = {R5 * RG) 


3.5.2 SDIV and UDIV 
Signed Divide and Unsigned Divide. 


SDIV{cond} {Rd,} Rn, Rm 
UDIV{cond} {Rd,} Rn, Rm 


Where: 
cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the register holding the value to be divided. 
Rm 
Is a register holding the divisor. 
Operation 
The SDIV instruction performs a signed integer division of the value in Rn by the value in Rm. 
The UDIV instruction performs an unsigned integer division of the value in Rn by the value in Rm. 
For both instructions, if the value in Rn is not divisible by the value in Rm, the result is rounded towards zero. 
For the Cortex-M33 processor, the integer divide operation latency is in the range of 2-11 cycles. 
Restrictions 
Do not use SP and do not use PC. 
Condition flags 
These instructions do not change the flags. 
SDIV RO, R2, R4 ; Signed divide, RO = R2/R4 
UDIV R8, R8, Rl ; Unsigned divide, R8 = R8/R1 
3.5.3 SMLAWB, SMLAWT, SMLABB, SMLABT, SMLATB, and SMLATT 


Signed Multiply Accumulate (halfwords). 


op{cond} Rd, Rn, Rm, Ra 
Where: 
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op 
Is one of: 
SMLAWB 


Signed Multiply Accumulate (word by halfword) 
The bottom halfword, bits [15:0], of Rm is used. 


SMLAWT 


Signed Multiply Accumulate (word by halfword) 
The top halfword, bits [31:16] of Rm is used. 


SMLABB, SMLABT 


Signed Multiply Accumulate Long (halfwords) 
The bottom halfword, bits [15:0], of Rmis used. 


SMLATB, SMLATT 


Signed Multiply Accumulate Long (halfwords) 
The top halfword, bits [31:16] of Rm is used. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. 
Rn, Rm 
Are registers holding the values to be multiplied. 
Ra 


Is a register holding the value to be added or subtracted from. 


Operation 


The SMLABB, SMLABT, SMLATB, SMLATT instructions: 

° Multiply the specified signed halfword, top or bottom, values from Rn and Rm. 
° Add the value in Ra to the resulting 32-bit product. 

. Write the result of the multiplication and addition in Rd. 





The non-specified halfwords of the source registers are ignored. 
The SMLAWB and SMLAWT instructions: 
° Multiply the 32-bit signed values in Rn with: 
— The top signed halfword of Rm, T instruction suffix. 
- The bottom signed halfword of Rm, B instruction suffix. 
. Add the 32-bit signed value in Ra to the top 32 bits of the 48-bit product 
. Write the result of the multiplication and addition in Ra. 
The bottom 16 bits of the 48-bit product are ignored. 


If overflow occurs during the addition of the accumulate value, the SMLAWB, SMLAWT, instruction sets the Q flag in 
the APSR. No overflow can occur during the multiplication. 


Restrictions 


In these instructions, do not use SP and do not use PC. 


Condition flags 


If an overflow is detected, the Q flag is set. 


PM0264 - Rev 1 page 98/245 





<] 


PM0264 


Multiply and divide instructions 





SMLABB R5, R6, R4, Rl ; Multiplies bottom halfwords of R6 and R4, adds 


7 Ril and writes to R5. 


SMLATB RS, R6, R4, Rl 7 Multiplies top halfword of RG with bottom halfword 


; of R4, adds R1 and writes to RD. 








SMLATT RS, R6, R4, Rl 7 Multiplies top halfwords of RG and R4, adds 
; Rl and writes the sum to R5. 
SMLABT R5, R6, R4, Rl ; Multiplies bottom halfword of R6 with top halfword 
; of R4, adds R1 and writes to RD. 
SMLABT R4, R3, R2 7 Multiplies bottom halfword of R4 with top halfword of 


SULAWB RIO, R2, RS, RS 7 Multiplies R2 with bottom halfword of RS, adds 








SMLAWT 


; R3, adds R2 and writes to R4. 








7 RS to the result and writes top 32-pits to Rid. 
RLO, R2, Rl, RS 7 Multiplies R2 with top balfword of Ri, adds RS 
? atc weites top 22-bite to RL. 











3.5.4 SMLAD and SMLADX 


Signed 


Multiply Accumulate Long Dual, Signed Multiply Accumulate Long Dual exchange. 


op{X}{cona} Rd, Rn, Rm, Ra 


Where: 
op 
Is one 
SMLAD 


of: 


Signed Multiply Accumulate Long Dual. 


SMLADX 


Signed Multiply Accumulate Long Dual exchange. 
X specifies which halfword of the source register Rn is used as the multiply operand. 


If X is omitted, the multiplications are bottom x bottom and top x top. 


If X is present, the mu 


cond 


Itiplications are bottom x top and top x bottom. 


Is an optional condition code. 


Rd 


Is the destination register. 


Rn 


Is the first operand register holding the values to be multiplied. 


Rm 


Is the second operand register. 


Ra 


Is the accumulate value. 


Operation 


The SMI 
The SMI 


LAD and SMLADx instructions regard the two operands as four halfword 16-bit values. 





LAD instruction: 


1. | Multiplies the top signed halfword value in Rn with the top signed halfword of Rm and the bottom signed 
halfword value in Rn with the bottom signed halfword of Rm. 


2. Adds both multiplication results to the signed 32-bit value in Ra. 
3. Writes the 32-bit signed result of the multiplication and addition to Rd. 
The SMLADX instruction: 


1. Multiplies the top signed halfword value in Rn with the bottom signed halfword of Rm and the bottom signed 
halfword value in Rn with the top signed halfword of Rm. 


2. Adds both multiplication results to the signed 32-bit value in Ra. 
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3. Writes the 32-bit signed result of the multiplication and addition to Rd. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


Sets the Q flag if the accumulate operation overflows. 


SMLAD RO), , vil, IRS) Multiplies two halfword values in R2 with 
corresponding halfwords in Rl, adds R5 and writes to 
R10. 

Multiplies top halfword of R2 with bottom halfword 
of R4, multiplies bottom halfword of R2 with top 


halfword of R4, adds R6 and writes to RO. 


SMLALDX RO, R2, R4, RG 


So oh oh oh sa S48 


3.5.5 SMLALD, SMLALDX, SMLALBB, SMLALBT, SMLALTB, and SMLALTT 
Signed Multiply Accumulate Long Dual and Signed Multiply Accumulate Long (halfwords). 


op{cond} RdLo, RdHi, Rn, Rm 

Where: 
op 

Is one of: 

SMLALBB, SMLALBT 
Signed Multiply Accumulate Long (halfwords, B and T). 
B and T specify which halfword of the source registers Rn and Rm are used as the first and second multiply operand: 
The bottom halfword, bits [15:0], of Rn is used. 
SMLALBB: the bottom halfword, bits [15:0], of Rm is used. SMLALBT: the top halfword, bits [31:16], of Rm is used. 
SMLALTB, SMLALTT 
Signed Multiply Accumulate Long (halfwords, B and T). 
The top halfword, bits [31:16], of Rn is used. 
SMLALTB: the bottom halfword, bits [15:0], of Rm is used. SMLALTT: the top halfword, bits [31:16], of Rm is used. 
SMLALD 
Signed Multiply Accumulate Long Dual. 
The multiplications are bottom x bottom and top ~* top. 
SMLALDX 
Signed Multiply Accumulate Long Dual reversed. 
The multiplications are bottom x top and top x bottom. 


cond 
Is an optional condition code. 

RdHi, RdLo 
Are the destination registers. RdLo is the lower 32 bits and RdHi is the upper 32 bits of the 64-bit integer. The 
accumulating value for the lower and upper 32 bits are held in the RdLo and RdHi registers respectively. 

Rn, Rm 


Are registers holding the first and second operands. 


Operation 


° Multiplies the two’s complement signed word values from Rn and Rm. 
° Adds the 64-bit value in RdLo and RdbHi to the resulting 64-bit product. 
° Writes the 64-bit result of the multiplication and addition in RdLo and RdHi. 
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The SMLALBB, SMLALBT, SMLALTB and SMLALTT instructions: 

° Multiplies the specified signed halfword, Top or Bottom, values from Rn and Rm. 

. Adds the resulting sign-extended 32-bit product to the 64-bit value in RdLo and RdHi. 
. Writes the 64-bit result of the multiplication and addition in RdLo and RdHi. 





The non-specified halfwords of the source registers are ignored. 
The SMLALD and SMLALDx instructions interpret the values from Rn and Rm as four halfword two’s complement 
signed 16-bit integers. These instructions: 


. SMLALD multiplies the top signed halfword value of Rn with the top signed halfword of Rm and the bottom 
signed halfword values of Rn with the bottom signed halfword of Rm. 











. SMLALDX multiplies the top signed halfword value of Rn with the bottom signed halfword of Rm and the 
bottom signed halfword values of Rn with the top signed halfword of Rm. 

. Add the two multiplication results to the signed 64-bit value in RdLo and RdHi to create the resulting 64-bit 
product. 

° Write the 64-bit product in RdLo and RdHi. 





Restrictions 


In these instructions: 
° Do not use SP and do not use PC. 
° RdHi and RdLo must be different registers. 


Condition flags 


These instructions do not affect the condition code flags. 


SMLALBT RA, Rul, IRGp IR Multiplies bottom halfword of R6 with top 
halfword of R/, Sign extends to 32-bit, adds 

RU GIR! Ginel wreaieSs. jee) IU GIR. 

Multiplies top halfword of R6 with bottom 
haltiword of Ri, e.gn ettends to S2—-oit, adds RivR2 
and writes to R1:R2. 

Multiplies top halfwords in R5 and R1 and bottom 
halfwords of R5 and R1, adds R8:R6 and writes to 
EES lon 
Multiplies top halfword in R5 with bottom 
halfword of Rl, and bottom halfword of R5 with 
top halfword of Rl, adds R8:R6 and writes to 
los 


SMLALTB R22, Ril, RG, RT 


SMLALD R6, R8, R5, Rl 




















SMLALDX R6, R8, R5, Rl 











Sree a a i i i. i a. Cin Cin Ty) 


SMLSD and SMLSLD 
Signed Multiply Subtract Dual and Signed Multiply Subtract Long Dual. 
op{X}{conad} Rd, Rn, Rm, Ra; SMLSD 


op{X}{conad} RdLo, RdHi, Rn, Rm; SMLSLD 
Where: 
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op 
Is one of: 
SMLSD 


Signed Multiply Subtract Dual. 
SMLSDX 


Signed Multiply Subtract Dual reversed. 
SMLSLD 


Signed Multiply Subtract Long Dual. 
SMLSLDX 


Signed Multiply Subtract Long Dual reversed. 


If X is present, the multiplications are bottom x top and top x bottom. If the x is omitted, the multiplications are 
bottom x bottom and top ~ top. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. 
Rn, Rm 
Are registers holding the first and second operands. 
Ra 
Is the register holding the accumulate value. 
RdLo 
Supplies the lower 32 bits of the accumulate value, and is the destination register for the lower 32 bits of the 
result. 
RdHi 
Supplies the upper 32 bits of the accumulate value, and is the destination register for the upper 32 bits of the 
result. 
Operation 


The SMLSD instruction interprets the values from the first and second operands as four signed halfwords. This 
instruction: 


° Optionally rotates the halfwords of the second operand. 

° Performs two signed 16 x 16-bit halfword multiplications. 

. Subtracts the result of the upper halfword multiplication from the result of the lower halfword multiplication. 
° Adds the signed accumulate value to the result of the subtraction. 

° Writes the result of the addition to the destination register. 


The SMLSLD instruction interprets the values from Rn and Rm as four signed halfwords. This instruction: 

° Optionally rotates the halfwords of the second operand. 

. Performs two signed 16 x 16-bit halfword multiplications. 

. Subtracts the result of the upper halfword multiplication from the result of the lower halfword multiplication. 
. Adds the 64-bit value in RdHi and RdLo to the result of the subtraction. 

° Writes the 64-bit result of the addition to the RdHi and RdLo. 


Restrictions 


In these instructions: 
° Do not use SP and do not use PC. 
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op 


SMMLA 


Condition flags 


The SMLSD{ xX} instruction sets the Q flag if the accumulate operation overflows. Overflow cannot occur during the 
multiplications or subtraction. 


For the T32 instruction set, these instructions do not affect the condition code flags. 


SMLSD RAO), IRM TES), INS) ; Multiplies bottom halfword of R4 with bottom 
7 halfword of R5, multiplies top halfword of R4 
7 with top halfword of R5, subtracts second from 
pA isliecie, eicleliss ING, veslieeisy eo J2il0), 
RO ; Multiplies bottom halfword of R3 with top 
? halfword of R2, multiplies top halfword of R& 
; with bottom halfword of R2, subtracts second from 
p ialiecic, iclels IN), vwWHealieee) (eo Jetil 
Ra) ; Multiplies bottom halfword of R6 with bottom 
7 halfword of R2, multiplies top halfword of R6 
7 with top halfword of R2, subtracts second from 
Fe Elest, adds RGIRS wrttes GO uRGaRS 
R7 ; Multiplies bottom halfword of R6 with top 
; halfword of R2, multiplies top halfword of R6 
; with bottom halfword of R2, subtracts second from 


FLAS, accs RO RS) awit lies EO mRGaRoe 


SMLSDX Ri, iB, i, 


SMLSLD R3, R6, R2, 




















SMLSLDX Ra, BG, Be; 














SMMLA and SMMLS 
Signed Most Significant Word Multiply Accumulate and Signed Most Significant Word Multiply Subtract. 


op{R}\ cond} Rd, Rn, Rm, Ra 
Where: 


Is one of: 


Signed Most Significant Word Multiply Accumulate. 


SMMLS 


Signed Most Significant Word Multiply Subtract. 


R 


cond 


Rd 


Rn, Rm 


Ra 
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If R is present, the result is rounded instead of being truncated. In this case the constant 0x80000000 is added to 
the product before the top halfword is extracted. 


Is an optional condition code. 


Is the destination register. 


Are registers holding the first and second multiply operands. 


Is the register holding the accumulate value. 


Operation 


The SMMLA instruction interprets the values from Rn and Rm as signed 32-bit words. 
The SMMLA instruction: 

° Multiplies the values in Rn and Rm. 

° Optionally rounds the result by adding 0Ox80000000. 

. Extracts the most significant 32 bits of the result. 
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. Adds the value of Ra to the signed extracted value. 
° Writes the result of the addition in Ra. 


The SMMLS instruction interprets the values from Rn and Rmas signed 32-bit words. 
The SMMLS instruction: 

° Multiplies the values in Rn and Rm. 

° Optionally rounds the result by adding 0x80000000. 

. Extracts the most significant 32 bits of the result. 

. Subtracts the extracted value of the result from the value in Ra. 

. Writes the result of the subtraction in Rd. 





Restrictions 

In these instructions: 

° Do not use SP and do not use PC. 
Condition flags 


These instructions do not affect the condition code flags. 


SMMLA RO), IME IRS), INS) 7? Multiplies R4 and RS, extracts top 32 bits, adds 
; R6, truncates and writes to RO. 

SMMLAR RG), IRV, Teel, Ievil ? Multiplies R2 and Ri, extracts top 32 bits, adds 
; R4, rounds and writes to R6. 

SMMLSR RS, IG, V2, IeT 7 Multiplies R6 and RZ, extracts top 32 bits, 
; subtracts R7, rounds and writes to R3. 

SMMLS yA IRS TS), Jes 7? Multiplies RS and R3, extracts top 32 bits, 
; subtracts R8, truncates and writes to R4. 

3.5.8 SMMUL 


Signed Most Significant Word Multiply. 
op{R}{cond} Rd, Rn, Rm 
Where: 
op 
Is one of: 
SMMUL 


Signed Most Significant Word Multiply. 


R 
If R is present, the result is rounded instead of being truncated. In this case the constant 0x80000000 is added to 
the product before the top halfword is extracted. 
cond 
Is an optional condition code. 
Rd 
Is the destination register. 
Rn, Rm 


Are registers holding the first and second operands. 


Operation 

The SMMUL instruction interprets the values from Rn and Rm as two’s complement 32-bit signed integers. The 
SMMUL instruction: 

. Multiplies the values from Rn and Rm. 

° Optionally rounds the result, otherwise truncates the result. 

. Writes the most significant signed 32 bits of the result in Rd. 
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Restrictions 

In this instruction: 

° Do not use SP and do not use PC. 
Condition flags 


This instruction does not affect the condition code flags. 


SMMUL RO, R4, R5 7? Multipltes R4 and RS, trumcates top 32 bits 
p ano writes to RO. 
SMMULR R6, R2 ? Multipltes R6 amd Kz, sounds the top 32 bits 
p and writes to RG. 
3.5.9 SMUAD and SMUSD 


Signed Dual Multiply Add and Signed Dual Multiply Subtract. 


op{X}{cona} Rd, Rn, Rm 


Where: 
op 
Is one of: 
SMUAD 
Signed Dual Multiply Add. 
SMUADX 


Signed Dual Multiply Add reversed. 
SMUSD 


Signed Dual Multiply Subtract. 
SMUSDX 


Signed Dual Multiply Subtract reversed. 


If X is present, the multiplications are bottom x top and top x bottom. If the x is omitted, the multiplications are 
bottom x bottom and top ~ top. 


cond 

Is an optional condition code. 
Rd 

Is the destination register. 
Rn, Rm 


Are registers holding the first and the second operands. 


Operation 


The SMUAD instruction interprets the values from the first and second operands as two signed halfwords in each 
operand. This instruction: 


° Optionally rotates the halfwords of the second operand. 

. Performs two signed 16 x 16-bit multiplications. 

. Adds the two multiplication results together. 

° Writes the result of the addition to the destination register. 

The SMUSD instruction interprets the values from the first and second operands as two’s complement signed 
integers. This instruction: 

° Optionally rotates the halfwords of the second operand. 

. Performs two signed 16 x 16-bit multiplications. 
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. Subtracts the result of the top halfword multiplication from the result of the bottom halfword multiplication. 
. Writes the result of the subtraction to the destination register. 


Restrictions 


In these instructions: 
° Do not use SP and do not use PC. 


Condition flags 


SMUAD, SMUADxX set the Q flag if the addition overflows. The multiplications cannot overflow. 


SMUAD RO, BWA, IS Multiplies bottom halfword of R4 with the bottom 
haltword of RS, eacds multiplication of top healtword 
of R4 with top halfword of RS, writes to RO. 
Multiplies bottom halfword of R7 with top halfword 

of R4, adds multiplication of top halfword of R7 

with bottom halfword of R4, writes to R3. 

Multiplies bottom halfword of R4 with bottom halfword 
of R6, subtracts multiplication of top halfword of R6 
with top halfword of R3, writes to R23. 

Multiplies bottom halfword of R5 with top halfword of 
INS, Blois mbolllieaollate<yealeinl Gre (ewe) Inellicyyouetcl ie IRS) 
with bottom halfword of R3, writes to R4. 


SMUADX Ra, Ri, Re 


SMUSD Rip ING, Ie 


























SMUSDX Bl, IRS)p IRS) 





So 50 50 Sh So S08 S08 So Sh So Sh Sn 


3.5.10 SMUL and SMULW 
Signed Multiply (halfwords) and Signed Multiply (word by halfword). 
op{XY¥}{cond} Rd,Rn, Rm; SMUL 


op{Y}{cond} Rd. Rn, Rm; SMULW 
For SMUL {XY} only: 





op 
Is one of SMULBB, SMULBT, SMULTB, SMULTT: 
SMUL{ XY} Signed Multiply (halfwords) 
X and Y specify which halfword of the source registers Rn and Rmis used as the first and second multiply 
operand. If xis B, then the bottom halfword, bits [15:0] of Rn is used. If x is T, then the top halfword, bits [31:16] 
of Rn is used. If yis B, then the bottom halfword, bits [15:0], of Rm is used. If yis T, then the top halfword, bits 
[31:16], of Rmis used. 
SMULW{ Y} Signed Multiply (word by halfword) 
Y specifies which halfword of the source register Rm is used as the second multiply operand. If yis B, then the 
bottom halfword (bits [15:0]) of Rm is used. If yis T, then the top halfword (bits [31:16]) of Rmis used. 

cond 
Is an optional condition code. 

Rd 
Is the destination register. 

Rn, Rm 


Are registers holding the first and second operands. 


Operation 





The SMULBB, SMULTB, SMULBT and SMULTT instructions interprets the values from Rn and Rm as four signed 16- 
bit integers. 


These instructions: 
° Multiply the specified signed halfword, Top or Bottom, values from Rn and Rm. 
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. Write the 32-bit result of the multiplication in Rd. 


The SMULWT and SMULWB instructions interprets the values from Rn as a 32-bit signed integer and Rm as two 
halfword 16-bit signed integers. These instructions: 


. Multiply the first operand and the top, T suffix, or the bottom, B suffix, halfword of the second operand. 
. Write the signed most significant 32 bits of the 48-bit result in the destination register. 


Restrictions 


In these instructions: 
. Do not use SP and do not use PC. 
° RdHi and RdLo must be different registers. 


SMULBT RO, IVA, 1eN5) 7 Multiplies the bottom halfword of R4 with the 
7 top halfword of RS, multiplies results and 

f Wwrlees: tO) ROk 

SMULBB RO), IVA, 1ee5) 7 Multiplies the bottom halfword of R4 with the 
7 bottom halfword of R5, multiplies results and 
Fo Wwirlees: on RO 





SMULTT PU 4G 7 Multiplies the top halfword of R4 with the top 
7 halfword of R5, multiplies results and writes 
Peon, 

SMULTB RUG), VA IRS 7 Multiplies the top halfword of R4 with the 


7 bottom halfword of R5, multiplies results and 
; and writes to RO. 























SMULWT Sv, IRS), IRS) 7 Multiplies R5 with the top halfword of R3, 
7 extracts top 32 bits and writes to R4. 
SMULWB Bl IRS) 1RAS) 7 Multiplies R5 with the bottom halfword of R3, 


7 extracts top 32 bits and writes to R4. 


3.5.11 UMULL, UMAAL, UMLAL, SMULL, and SMLAL 
Signed and Unsigned Multiply Long, with optional Accumulate, using 32-bit operands and producing a 64-bit 
result. 
op{cond} RdLo, RdHi, Rn, Rm 
Where: 
op 
Is one of: 
UMULL 


Unsigned Multiply Long. 

UMLAL 

Unsigned Multiply, with Accumulate Long. 

UMAAL 

Unsigned Long Multiply with Accumulate Accumulate. 
SMULL 

Signed Multiply Long. 

SMLAL 

Signed Multiply, with Accumulate Long. 

cond 


Is an optional condition code. 
RdHi, RdLo 


Are the destination registers. For UMLAL and SMLAL they also hold the accumulating value of the lower and 
upper words respectively. 
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Rn, Rm 
Are registers holding the operands. 
Operation 
The UMULL instruction interprets the values from Rn and Rm as unsigned integers. It multiplies these integers and 
places the least significant 32 bits of the result in RdLo, and the most significant 32 bits of the result in RdHi. 
The UMLAL instruction interprets the values from Rn and Rm as unsigned integers. It multiplies these integers, 
adds the 64-bit result to the 64-bit unsigned integer contained in RdHi and RadLo, and writes the result back to 
RdHi and RdLo. 
The UMAAL instruction interprets the values from Rn and Rm as unsigned integers. It multiplies these integers, 
adds the unsigned 32-bit integer in RdHi to the 64-bit result of the multiplication, adds the unsigned 32-bit integer 
in RdLo to the 64-bit result of the addition, writes the top 32-bits of the result to RdHi and writes the lower 32-bits 
of the result to RdLo. 
The SMULL instruction interprets the values from Rn and Rm as two’s complement signed integers. It multiplies 
these integers and places the least significant 32 bits of the result in RdLo, and the most significant 32 bits of the 
result in RdHi. 
The SMLAL instruction interprets the values from Rn and Rm as two’s complement signed integers. It multiplies 
these integers, adds the 64-bit result to the 64-bit signed integer contained in RdHi and RdLo, and writes the 
result back to RdHi and RdLo. 
Restrictions 
In these instructions: 
° Do not use SP and do not use PC. 
. RdHi and RdLo must be different registers. 
Condition flags 
These instructions do not affect the condition code flags. 
UMULL RO, R47 RS, RO Unsigned (R40) — Ros RG 
SMLAL RV, RS, 8S, IRE oF Silemecl (AS ,nV) = (RG piv) 4 IRE) = ine 

3.6 Saturating instructions 


Table 36 shows the saturating instructions: 


Table 36. Saturating instructions 





QADD Saturating Add Section 3.6.3 QADD and QSUB 
QASX Saturating Add and Subtract with Exchange Section 3.6.4 QASX and QSAX 
QDADD Saturating Double and Add Section 3.6.5 QDADD and QDSUB 
QDSUB Saturating Double and Subtract Section 3.6.5 QDADD and QDSUB 
QSAX Saturating Subtract and Add with Exchange Section 3.6.4 QASX and QSAX 
QSUB Saturating Subtract Section 3.6.3 QADD and QSUB 
QSUB16 Saturating Subtract 16 Section 3.6.3 QADD and QSUB 
SSAT Signed Saturate Section 3.6.1 SSAT and USAT 
SSAT16 Signed Saturate Halfword Section 3.6.2 SSAT16 and USAT16 
UQADD16 Unsigned Saturating Add 16 Section 3.6.7 UQADD and UQSUB 
UQADD8 Unsigned Saturating Add 8 Section 3.6.7 UQADD and UQSUB 
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UQASX Unsigned Saturating Add and Subtract with Exchange Section 3.6.6 UQASX and UQSAX 
UQSAX Unsigned Saturating Subtract and Add with Exchange Section 3.6.6 UQASX and UQSAX 
UQSUB16 Unsigned Saturating Subtract 16 Section 3.6.7 UQADD and UQSUB 
UQSUB8 Unsigned Saturating Subtract 8 Section 3.6.7 UQADD and UQSUB 
USAT Unsigned Saturate Section 3.6.1 SSAT and USAT 
USAT16 Unsigned Saturate Halfword Section 3.6.2 SSAT16 and USAT16 


For signed n-bit saturation, this means that: 

° If the value to be saturated is less than -2"-7, the result returned is -27-7 

° If the value to be saturated is greater than 2-1-4 the result returned is 2-7-1 
° Otherwise, the result returned is the same as the value to be saturated. 

For unsigned n-bit saturation, this means that: 

° If the value to be saturated is less than 0, the result returned is 0 

° If the value to be saturated is greater than 2"-1, the result returned is 2-1 

° Otherwise, the result returned is the same as the value to be saturated. 


If the returned result is different from the value to be saturated, it is called saturation. If saturation occurs, the 
instruction sets the Q flag to 1 in the APSR. Otherwise, it leaves the Q flag unchanged. To clear the Q flag to 0, 
you must use the MSR instruction. 


To read the state of the Q flag, use the MRS instruction. 


3.6.1 SSAT and USAT 


Signed Saturate and Unsigned Saturate to any bit position, with optional shift before saturating. 


op{cond} Rd, #n, Rm{, shift #s} 
Where: 
op 
Is one of: 
SSAT 
Saturates a signed value to a signed range. 
USAT 


Saturates a signed value to an unsigned range. 





cond 
Is an optional condition code. 
Rd 
Is the destination register. 
n 
Specifies the bit position to saturate to: 
. nranges from 1 to 32 for SSAT. 
° n ranges from 0 to 31 for USAT. 
Rm 


Is the register containing the value to saturate. 
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shift #s 
Is an optional shift applied to Rm before saturating. It must be one of the following: 
ASR #s 
where s is in the range 1-31. 
LSL #s 


where s is in the range 0-31. 


Operation 


These instructions saturate to a signed or unsigned n-bit value. 
The SSAT instruction applies the specified shift, then saturates to the signed range -2"-' < x < 2-1-1, 





The USAT instruction applies the specified shift, then saturates to the unsigned range 0 < x < 2"-1. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the condition code flags. 
If saturation occurs, these instructions set the Q flag to 1. 


SSAT R7, #16, R7, LSL #4 Logical shift left value in R7 by 4, then 
saturate it as a signed 16-bit value and 
WElte it back to Ri, 

Conditionally saturate value in R5 as an 


unsigned 7 bit value and write it to RO. 


USATNE RO, #7, RS 


Ne Ne Ne Me Ne 


3.6.2 SSAT16 and USAT16 


Signed Saturate and Unsigned Saturate to any bit position for two halfwords. 


op{cond} Rd, #n, Rm 
Where: 
op 
Is one of: 
SSAT16 
Saturates a signed halfword value to a signed range. 
USAT16 


Saturates a signed halfword value to an unsigned range. 





cond 
Is an optional condition code. 
Rd 
Is the destination register. 
n 
Specifies the bit position to saturate to: 
. nranges from 1 to 16 for SSAT. 
. nranges from 0 to 15 for USAT. 
Rm 


Is the register containing the values to saturate. 
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3.6.3 


op 


QADD 


Operation 


The SSAT16 instruction: 


1. Saturates two signed 16-bit halfword values of the register with the value to saturate from selected by the bit 
position in n. 


2. Writes the results as two signed 16-bit halfwords to the destination register. 

The USAT 16 instruction: 

1. Saturates two unsigned 16-bit halfword values of the register with the value to saturate from selected by the 
bit position in n. 

2. Writes the results as two unsigned halfwords in the destination register. 

Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the condition code flags. 
If saturation occurs, these instructions set the Q flag to 1. 


SSAT16 R7, #9, R2 7 Saturates the top and bottom highwords of R2 
7 as 9-bit values, writes to corresponding halfword 
Bie IR 6 

USATI6NE RO, #13, R5 7 Conditionally saturates the top and bottom 


; halfwords of R5 as 13-bit values, writes to 
7 corresponding halfword of RO. 


QADD and QSUB 
Saturating Add and Saturating Subtract, signed. 


op{cond} {Rd,} Rn, Rm 
Where: 


Is one of: 


Saturating 32-bit add. 


QADD8 


Saturating four 8-bit integer additions. 


QADD16 


Saturating two 16-bit integer additions. 


QSUB 


Saturating 32-bit subtraction. 


QSUB8 


Saturating four 8-bit integer subtraction. 


QSUB16 


Saturating two 16-bit integer subtraction. 


cond 


Rd 
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Is an optional condition code. 


Is the destination register. If Rd is omitted, the destination register is Rn. 
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Rn, Rm 


Are registers holding the first and second operands. 


Operation 

These instructions add or subtract two, four or eight values from the first and second operands and then writes a 
signed saturated value in the destination register. 

The QADD and QSUB instructions apply the specified add or subtract, and then saturate the result to the signed 
range -2"-1 < x < 2-1-1, where x is given by the number of bits applied in the instruction, 32, 16 or 8. 


If the returned result is different from the value to be saturated, it is called saturation. If saturation occurs, the 
QADD and QSUB instructions set the Q flag to 1 in the APSR. Otherwise, it leaves the Q flag unchanged. The 8-bit 
and 16-bit QADD and QSUB instructions always leave the Q flag unchanged. 


To clear the Q flag to 0, you must use the MSR instruction. 
To read the state of the Q flag, use the MRS instruction. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the condition code flags. 
If saturation occurs, the QADD and QSUB instructions set the Q flag to 1. 


QADD16 R7, R4, R2 ; Adds halfwords of R4 with corresponding halfword of 
; R2, saturates to 16 bits and writes to corresponding 
O lneiilseiiewetel (eye ISk7)c 


QADD8 R3, Rl, R6 ; Adds bytes of Rl to the corresponding bytes of R6, 
7; Saturates to 8 bits and writes to corresponding byte of 
EO LESS 














QSUB16 Ra, Re, RS 7 SUbtracts Naliwords of Ba from corresponding falivord 
7 O£ R2, Saturates to 16 bits, writes to corresponding 
7 halktword of IRA. 











QSUB8 R4, R2, RS ; Subtracts bytes of R5| from the corresponding byte in 
; R2, saturates to 8 bits, writes to corresponding byte of 
ease 


3.6.4 QASX and QSAX 
Saturating Add and Subtract with Exchange and Saturating Subtract and Add with Exchange, signed. 


op{cond} {Rd,} Rn, Rm 
Where: 
op 
Is one of: 
QASX 
Add and Subtract with Exchange and Saturate. 
QSAX 
Subtract and Add with Exchange and Saturate. 
cond 
Is an optional condition code. 
Rd 


Is the destination register. If Rd is omitted, the destination register is Rn. 
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Rn, Rm 


3.6.5 


op 


QDADD 


Are registers holding the first and second operands. 


Operation 


The OASx instruction: 
1. Adds the top halfword of the source operand with the bottom halfword of the second operand. 
2. | Subtracts the top halfword of the second operand from the bottom highword of the first operand. 


3. | Saturates the result of the subtraction and writes a 16-bit signed integer in the range —215 < x s 215-1, 
where x equals 16, to the bottom halfword of the destination register. 


4. Saturates the results of the sum and writes a 16-bit signed integer in the range —215 < x < 215 — 1, where x 
equals 16, to the top halfword of the destination register. 


The QSAxX instruction: 

1. | Subtracts the bottom halfword of the second operand from the top highword of the first operand. 

2. Adds the bottom halfword of the source operand with the top halfword of the second operand. 

3. Saturates the results of the sum and writes a 16-bit signed integer in the range —215 s x $ 215 — 1, where x 
equals 16, to the bottom halfword of the destination register. 

4. Saturates the result of the subtraction and writes a 16-bit signed integer in the range —215 s x $ 215-1, 
where x equals 16, to the top halfword of the destination register. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the condition code flags. 


QASX Ri, Ra) R2 Adds top halfword of R4 to bottom halfword of R2, 
Saturates to 16 bits, writes to top halfword of R7 
Subtracts top bighword of R2 from bottom haltiword of 
R4, saturates to 16 bits and writes to bottom halfword 


Ge iy) 


So Sn So So Sn 


QSAX RO, RS, IRS) Subtracts bottom halfword of R5 from top halfword of 
Ra, Saturates to 16 bits, writes to top halftword of RO 
Adds bottom halfword of R3 to top halfword of R5, 


saturates to 16 bits, writes to bottom halfword of RO. 


Se ye se Me 


QDADD and QDSUB 
Saturating Double and Add and Saturating Double and Subtract, signed. 


op{cond} {Rd}, Rm, Rn 
Where: 


Is one of: 


Saturating Double and Add. 


QDSUB 


Saturating Double and Subtract. 


cond 


Rd 
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Is an optional condition code. 


Is the destination register. If Rd is omitted, the destination register is Rn. 
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Rm, Rn 
Are registers holding the first and second operands. 
Operation 
The QDADD instruction: 
° Doubles the second operand value. 
. Adds the result of the doubling to the signed saturated value in the first operand. 
° Writes the result to the destination register. 
The ODSUB instruction: 
. Doubles the second operand value. 
° Subtracts the doubled value from the signed saturated value in the first operand. 
° Writes the result to the destination register. 
Both the doubling and the addition or subtraction have their results saturated to the 32-bit signed integer range — 
231 < x $ 231-1. If saturation occurs in either operation, it sets the Q flag in the APSR. 
Restrictions 
Do not use SP and do not use PC. 
Condition flags 
If saturation occurs, these instructions set the Q flag to 1. 
QDADD IR, UWA Rte ; Doubles and saturates R4 to 32 bits, adds R2, 
; Saturates to 32 bits, writes to R7 
QDSUB TRO); IRS}, IRS) ; Subtracts R3 doubled and saturated to 32 bits 
- ExomRS, (Satubates! tor s2 bles, writes) tool 
3.6.6 UQASX and UQSAX 
Saturating Add and Subtract with Exchange and Saturating Subtract and Add with Exchange, unsigned. 
op{cond} {Rd,} Rn, Rm 
Where: 
type 
Is one of: 
UQASX 


Add and Subtract with Exchange and Saturate. 
UQSAX 
Subtract and Add with Exchange and Saturate. 


cond 

Is an optional condition code. 
Rd 

Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn, Rm 


Are registers holding the first and second operands. 


Operation 


The UQASx instruction: 
1. Adds the bottom halfword of the source operand with the top halfword of the second operand. 
2. Subtracts the bottom halfword of the second operand from the top highword of the first operand. 
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3. Saturates the results of the sum and writes a 16-bit unsigned integer in the range 0 < x s 216 — 1, where x 
equals 16, to the top halfword of the destination register. 

4.  Saturates the result of the subtraction and writes a 16-bit unsigned integer in the range 0 < x $ 216 —1, 
where x equals 16, to the bottom halfword of the destination register. 

The UQSAX instruction: 

1. | Subtracts the bottom halfword of the second operand from the top highword of the first operand. 

2. Adds the bottom halfword of the first operand with the top halfword of the second operand. 

3.  Saturates the result of the subtraction and writes a 16-bit unsigned integer in the range 0 s x $ 216 — 1, 
where x equals 16, to the top halfword of the destination register. 


4. Saturates the results of the addition and writes a 16-bit unsigned integer in the range 0 < x s 216 — 1, where 
X equals 16, to the bottom halfword of the destination register. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the condition code flags. 


UQASX Ry, R42, R2 Adds top halfword of R4 with bottom halfword of R2, 
Saturates to 16 bits, writes to top halfword of R7 
Subtracts top halfword of R2 from bottom halfword of 

R4, saturates to 16 bits, writes to bottom halfword of R7 
Subtracts bottom halfword of R5 from top halfword of R3, 
saturates to 16 bits, writes to top halfword of RO 

Adds bottom halfword of R4 to top halfword of R95 
saturates to 16 bits, writes to bottom halfword of RO. 


UQSAX RO, RS, IRS) 


So Sh s Sh Sh sa sa oa 


3.6.7 UQADD and UQSUB 
Saturating Add and Saturating Subtract Unsigned. 


op{cond} {Rd,} Rn, Rm 

Where: 
op 

Is one of: 

UQADD8 
Saturating four unsigned 8-bit integer additions. 
UQADD16 
Saturating two unsigned 16-bit integer additions. 
UQSUB8 
Saturating four unsigned 8-bit integer subtractions. 
UQSUB16 


Saturating two unsigned 16-bit integer subtractions. 


cond 

Is an optional condition code. 
Rd 

Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn, Rm 


Are registers holding the first and second operands. 
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Operation 


These instructions add or subtract two or four values and then writes an unsigned saturated value in the 
destination register. 


The UQADD16 instruction: 
. Adds the respective top and bottom halfwords of the first and second operands. 


. Saturates the result of the additions for each halfword in the destination register to the unsigned range 0 < x 
< 216-1, where x is 16. 


The UQADD8 instruction: 

° Adds each respective byte of the first and second operands. 

. Saturates the result of the addition for each byte in the destination register to the unsigned range 0 s xs 
28-1, where x is 8. 

The UQSUB16 instruction: 

° Subtracts both halfwords of the second operand from the respective halfwords of the first operand. 

° Saturates the result of the differences in the destination register to the unsigned range 0 < x < 216-1, where 
xis 16. 

The UQSUB8 instructions: 

° Subtracts the respective bytes of the second operand from the respective bytes of the first operand. 


° Saturates the results of the differences for each byte in the destination register to the unsigned range 0 < x s 
28-1, where x is 8. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the condition code flags. 


UQADD16 R7, R4, R2 7 Adds halfwords in R4 to corresponding halfword in R2, 

7 saturates to 16 bits, writes to corresponding halfword 
iene” SEU 

UQADD8 BUA IRE RNS) 7 Adds bytes of R2 to corresponding byte of R5, saturates 
7 to 8 bits, writes to corresponding bytes of R4 

UQSUB16 R6, R3, RO 7 Subtracts halfwords in RO from corresponding halfword 

7 in R3, saturates to 16 bits, writes to corresponding 

P lneiilseiironetel alia’ 546) 

UQSUB8 eulbpe (Sei Ile ; Subtracts bytes in R6 from corresponding byte of R5, 

7 Saturates to 8 bits, writes to corresponding byte of Rl. 

















3.7 Packing and unpacking instructions 


Table 37 shows the instructions that operate on packing and unpacking data: 


Table 37. Packing and unpacking instructions 


PKH Pack Halfword Section 3.7.1 PKHBT and PKHTB 
SXTAB Extend 8 bits to 32 and add Section 3.7.2 SXTA and UXTA 
SXTAB16 Dual extend 8 bits to 16 and add Section 3.7.2 SXTA and UXTA 
SXTAH Extend 16 bits to 32 and add Section 3.7.2 SXTA and UXTA 
SXTB Sign extend a byte Section 3.7.3 SXT and UXT 
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SXTB16 Dual extend 8 bits to 16 and add Section 3.7.3 SXT and UXT 
SXTH Sign extend a halfword Section 3.7.3 SXT and UXT 
UXTAB Extend 8 bits to 32 and add Section 3.7.2 SXTA and UXTA 
UXTAB16 Dual extend 8 bits to 16 and add Section 3.7.2 SXTA and UXTA 
UXTAH Extend 16 bits to 32 and add Section 3.7.2 SXTA and UXTA 
UXTB Zero extend a byte Section 3.7.3 SXT and UXT 
UXTB16 Dual zero extend 8 bits to 16 and add Section 3.7.3 SXT and UXT 
UXTH Zero extend a halfword Section 3.7.3 SXT and UXT 
3.7.1 PKHBT and PKHTB 


Pack Halfword. 


op{cond} {Rad}, Rn, Rm {, LSL #imm} ;PKHBT 
op{cond} {Ra}, Rn, Rm {, ASR #imm} ;PKHTB 


Where: 
op 
Is one of: 
PKHBT 
Pack Halfword, bottom and top with shift. 
PKHTB 


Pack Halfword, top and bottom with shift. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 
Is the second operand register holding the value to be optionally shifted. 
imm 
Is the shift length. The type of shift length depends on the instruction:For PKHBT: 
For PKHTB: 
LSL 


A left shift with a shift length from 1 to 31, 0 means no shift. 
ASR 
An arithmetic shift right with a shift length from 1 to 32, a shift of 32-bits is encoded as 0b00000. 


Operation 


The PKHBT instruction: 

1. | Writes the value of the bottom halfword of the first operand to the bottom halfword of the destination register. 
2. — If shifted, the shifted value of the second operand is written to the top halfword of the destination register. 
The PKHTB instruction: 

1. | Writes the value of the top halfword of the first operand to the top halfword of the destination register. 

2. _ If shifted, the shifted value of the second operand is written to the bottom halfword of the destination register. 
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Restrictions 


Rd must not be SP and must not be PC. 


Condition flags 


This instruction does not change the flags. 


PKHBT R3, R4, RS LSL #0 ; Writes bottom halfword of R4 to bottom halfword of 
7 Ra, weites top halfword of KS, unshifted, to top 
; halfword of R3 


PKHTB R4, RO, R2 ASR #1 ; Writes R2 shifted right by 1 bit to bottom halfword 
7 Of R44, and writes top haltword of RO! to top 
7 haltword of R4. 
Sif2 SXTA and UXTA 
Signed and Unsigned Extend and Add. 
op{cond} {Rd,} Rn, Rm{, ROR #n} 
Where: 
op 
Is one of: 
SXTAB 


Sign extends an 8-bit value to a 32-bit value and add. 
SXTAH 

Sign extends a 16-bit value to a 32-bit value and add. 
SXTAB16 

Sign extends two 8-bit values to two 16-bit values and add. 
UXTAB 

Zero extends an 8-bit value to a 32-bit value and add. 
UXTAH 

Zero extends a 16-bit value to a 32-bit value and add. 
UXTAB16 


Zero extends two 8-bit values to two 16-bit values and add. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. If Rd is omitted, the destination register is Rn. 
Rn 
Is the first operand register. 
Rm 


Is the register holding the value to rotate and extend. 
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ROR #n 
Is one of: 
ROR #8 
Value from Rm is rotated right 8 bits. 
ROR #16 
Value from Rm is rotated right 16 bits. 
ROR #24 
Value from Rm is rotated right 24 bits. 


If ROR #n is omitted, no rotation is performed. 


Operation 


These instructions do the following: 
1. Rotate the value from Rm right by 0, 8, 16 or 24 bits. 
2. Extract bits from the resulting value: 
- SXTAB extracts bits[7:0] from Rm and sign extends to 32 bits. 
— _UXTAB extracts bits[7:0] from Rm and zero extends to 32 bits. 
- SXTAH extracts bits[15:0] from Rm and sign extends to 32 bits. 
— _UXTAH extracts bits[15:0] from Rm and zero extends to 32 bits. 
- SXTAB16 extracts bits[7:0] from Rm and sign extends to 16 bits, and extracts bits [23:16] from Rm and 
sign extends to 16 bits. 
— UXTAB16 extracts bits[7:0] from Rm and zero extends to 16 bits, and extracts bits [23:16] from Rm and 
zero extends to 16 bits. 


3. Adds the signed or zero extended value to the word or corresponding halfword of Rn and writes the result in 
Rd. 





Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the flags. 


SXTAH R4, R8, R6, ROR #16 Rotates Re eight by Ne bits, cotaine: botcom 
halfword, sign extends to 32 bits, adds R8,and 
writes to R4 

Extracts bottom byte of R10 and zero extends to 32 


bits, adds R4, and writes to R3. 


UATRB Roy 24 eo 


Ne Ne Ne te Ne 


3.7.3 SXT and UXT 
Sign extend and Zero extend. 
SXTop{cond} Rd, Rn {, ROR #n} 
UXT op{cond} Rd, Rn {, ROR #n} 
Where: 
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op 
Is one of: 
SXTB 


Sign extends an 8-bit value to a 32-bit value. 
SXTH 

Sign extends a 16-bit value to a 32-bit value. 
SXTB16 

Sign extends two 8-bit values to two 16-bit values. 
UXTB 

Zero extends an 8-bit value to a 32-bit value. 
UXTH 

Zero extends a 16-bit value to a 32-bit value. 
UXTB16 


Zero extends two 8-bit values to two 16-bit values. 


cond 
Is an optional condition code. 
Rd 
Is the destination register. 
Rn 
Is the register holding the value to extend. 
ROR #n 
Is one of: 
ROR #8 


Value from Rn is rotated right 8 bits. 
ROR #16 

Value from Rn is rotated right 16 bits. 
ROR #24 

Value from Rn is rotated right 24 bits. 


If ROR #n is omitted, no rotation is performed. 


Operation 


These instructions do the following: 

1. Rotate the value from Rn right by 0, 8, 16 or 24 bits. 

2. Extract bits from the resulting value: 
- SXTB extracts bits[7:0] and sign extends to 32 bits. 
— _UXTB extracts bits[7:0] and zero extends to 32 bits. 
- SXTH extracts bits[15:0] and sign extends to 32 bits. 
— _UXTH extracts bits[15:0] and zero extends to 32 bits. 


— SXTB16 extracts bits[7:0] and sign extends to 16 bits, and extracts bits [23:16] and sign extends to 16 


bits. 





— UXTB16 extracts bits[7:0] and zero extends to 16 bits, and extracts bits [23:16] and zero extends to 16 


bits. 


Restrictions 


Do not use SP and do not use PC. 
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Condition flags 


These instructions do not affect the flags. 


SXTH R4, R6, ROR #16 ; Rotate R6 right by 16 bits, then obtain the lower 
7 halfword of the result and then sign extend to 
7; 32 bits and write the result to R4. 

UXTB 3, RIO 7; Extract lowest byte of the value in R10 and zero 


extend it, and write the result to R3. 


3.8 Bit field instructions 


Table 38 shows the instructions that operate on adjacent sets of bits in registers or bit fields: 


Table 38. Bit field instructions 


BFC Bit Field Clear Section 3.8.1 BFC and BFI 

BFI Bit Field Insert Section 3.8.1 BFC and BFI 

SBFX Signed Bit Field Extract Section 3.8.2 SBFX and UBFX 

UBFX Unsigned Bit Field Extract Section 3.8.2 SBFX and UBFX 
3.8.1 BFC and BFI 


Bit Field Clear and Bit Field Insert. 


BFC{cond} Rd, #lsb, #width 
BF I{cond} Rd, Rn, #lsb, #width 


Where: 

cond 

Is an optional condition code. 
Rd 

Is the destination register. 
Rn 

Is the source register. 
Isb 

Is the position of the least significant bit of the bit field. /sb must be in the range 0-31. 
width 


Is the width of the bit field and must be in the range 1-32-/sb. 


Operation 


BFC Clears a bit field in a register. It clears width bits in Rd, starting at the low bit position 1sb. Other bits in Rd 
are unchanged. 


BFI copies a bit field into one register from another register. It replaces width bits in Rd starting at the low bit 
position 1sb, with width bits from Rn starting at bit[0]. Other bits in Rd are unchanged. 


Restrictions 


Do not use SP and do not use PC. 


Condition flags 


These instructions do not affect the flags. 
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BFC R4, #8, #12 Fe lca sb E Nom tom outa Om Giambi) mot eR tom0) 
BFI Ro, BZ, #8, #12 7 Replace bibs to bit 1S 2 bits) ot Ro wath 
bat UMro mit ll rom a2. 


3.8.2 SBFX and UBFX 
Signed Bit Field Extract and Unsigned Bit Field Extract. 


SBFX{cond} Rd, Rn, #lsb, #width 
UBFX{cond} Rd, Rn, #1sb, #width 


Where: 
cond 
Is an optional condition code. 
Rd 
Is the destination register. 
Rn 
Is the source register. 
Isb 
Is the position of the least significant bit of the bit field. /sb must be in the range 0-31. 
width 
Is the width of the bit field and must be in the range 1-32-1sb. 
Operation 
SBFx extracts a bit field from one register, sign extends it to 32 bits, and writes the result to the destination 
register. 
UBFX extracts a bit field from one register, zero extends it to 32 bits, and writes the result to the destination 
register. 
Restrictions 
Do not use SP and do not use PC. 
Condition flags 
These instructions do not affect the flags. 
Sielme INO, iil, qR20, GWA 6 lmbdcieereie Joule 20) tee lomic 23) (4 louliesss)) sexcoi aul Euavel altein 
7 extend to 32 bits and then write the result to RO. 
UBEX 8G, Rll, #9, #10 7 ERixact bit 9 to bit 1S {10 bits) from Ril ang zero 
7 extend to 32 bits and then write the result to R8. 
3.9 Branch and control instructions 
Reference material for the Cortex-M33 processor branch and control instruction set. 
3.9.1 List of branch and control instructions 


An alphabetically ordered list of the branch and control instructions, with a brief description and link to the syntax 
definition, operations, restrictions, and example usage for each instruction. 


Table 39. Branch and control instructions 


B Branch Section 3.9.2 B, BL, BX, and BLX 


BL Branch with Link Section 3.9.2 B, BL, BX, and BLX 
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BLX Branch indirect with Link Section 3.9.2 B, BL, BX, and BLX 

BLXNS Branch indirect with Link, Non-secure Section 3.9.3 BXNS and BLXNS 

BX Branch indirect Section 3.9.2 B, BL, BX, and BLX 

BXNS Branch indirect, Non-secure Section 3.9.3 BXNS and BLXNS 

CBNZ Compare and Branch if Non Zero Section 3.9.4 CBZ and CBNZ 

CBZ Compare and Branch if Zero Section 3.9.4 CBZ and CBNZ 

LT lf-Then Section 3.9.5 IT 

TBB Table Branch Byte Section 3.9.6 TBB and TBH 

TBH Table Branch Halfword Section 3.9.6 TBB and TBH 
3.9.2 B, BL, BX, and BLX 


Branch instructions. 


B{cona} label 


BL label 
BX Rm 
BLX Rm 
Where: 
cond 
Is an optional condition code. 
label 
Is a PC-relative expression. 
Rm 


Is a register providing the address to branch to. 


Operation 

All these instructions cause a branch to the address indicated by /abel or contained in the register specified by Rm. 
In addition: 

° The BL and BLX instructions write the address of the next instruction to LR, the link register R14. 

. The Bx and BLX instructions result in a UsageFault exception if bit[0] of Rm is 0. 


BL and BLX instructions also set bit[O] of the LR to 1. This ensures that the value is suitable for use by a 
subsequent POP {PC} or Bx instruction to perform a successful return branch. 





The following table shows the ranges for the various branch instructions. 


Table 40. Branch ranges 


a 


B label -2KB to +2KB. 

Bcond label -256 bytes to +254 bytes. 
BL label -16MB to +16MB. 

BX Rm Any value in register. 
BLX Rm Any value in register. 
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Note: 


3.9.3 


Rm 
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Restrictions 


In these instructions: 
° Do not use SP or PC in the Bx or BLX instruction. 


° For BX and BLX, bit[0] of Rm must be 1 for correct execution. Bit[0] is used to update the EPSR T-bit and is 
discarded from the target address. 


Bcond is the only conditional instruction on the processor. 
Bx can be used an Exception or Function return. 


Condition flags 


These instructions do not change the flags. 





Examples 
B loopA ; Branch to loopA 
BL sEUME ; Branch with link (Call) to function funC, return address 
y Seored 2 Ge 
BX LR 7 Reeurn) from funceion call at LR ycontains a EUNCERETURN value 
BLX RO ; Branch with link and exchange (Call) to a address stored 
B alia IO) 


BEQ labelD ; Conditionally branch to labelD if last flag setting 
7 instruction set the Z flag, else do not branch. 


BXNS and BLXNS 


Branch and Exchange Non-secure and Branch with Link and Exchange Non-secure. 
BXNS <Rm> 

BLXNS <Rm> 

Where: 


Is a register containing an address to branch to. 


Operation 
The BLXNS instruction calls a subroutine at an address contained in Rm and conditionally causes a transition from 
the Secure to the Non-secure state. 


For both BXNS and BLXNS, Rm[0] indicates a transition to Non-secure state if value is 0, otherwise the target state 
remains Secure. If transitioning to Non-secure, BLXNS pushes the return address and partial PSR to the Secure 
stack and assigns R14 to a FNC_RETURN value. 


These instructions are available for Secure state only. When the processor is in Non-secure state, these 
instructions are UNDEFINED and triggers a UsageFault if executed. 


Restrictions 


PC and SP cannot be used for Rm. 


Condition flags 


These instructions do not change the flags. 


Examples 


LDR r0, =non_secure function 

MOViSieatl mia 

BECSrerO; rile Clear bat OMot vaddresis) ainic0) 

BLXNS r0 ; Call Non-secure function. This sets r14 to FUNC RETURN value 
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Note: 


3.9.4 


cond 


Rn 


label 


3.9.5 
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For information about how to build a Secure image that uses a previously generated import library, see the Arm® 
Compiler Software Development Guide. 


CBZ and CBNZ 
Compare and Branch on Zero, Compare and Branch on Non-Zero. 


op{cond} Rn, label 
Where: 


Is an optional condition code. 
Is the register holding the operand. 


Is the branch destination. 


Operation 


Use the CBZ or CBNz instructions to avoid changing the condition code flags and to reduce the number of 
instructions. 


CBZ Rn, label does not change condition flags but is otherwise equivalent to: 


CMP Rn, #0 
BEQ label 





CBNZ Rn, label does not change condition flags but is otherwise equivalent to: 


CMP Rn, #0 
BNE label 
Restrictions 


The restrictions are: 

° Rn must be in the range of RO-R7. 

. The branch destination must be within 4 to 130 bytes after the instruction. 
. These instructions must not be used inside an IT block. 


Condition flags 


These instructions do not change the flags. 


CBZ R5;, tages, horward branch at RS) is) zero 
CBNZ RO, target ; Forward branch Tf RO! is) mote zero 


IT 
If-Then condition instruction. 
IT{x{y{z}}} cond 
Where: 
specifies the condition switch for the second instruction in the IT block. 


Specifies the condition switch for the third instruction in the IT block. 


Specifies the condition switch for the fourth instruction in the IT block. 
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cond 
Specifies the condition for the first instruction in the IT block. 
The condition switch for the second, third and fourth instruction in the IT block can be either: 
7 Then. Applies the condition cond to the instruction. 
E Else. Applies the inverse condition of cond to the instruction. 
Note: It is possible to use AL (the always condition) for cond in an IT instruction. If this is done, all of the instructions 
in the IT block must be unconditional, and each of x, y, and z must be T or omitted but not E. 
Operation 
The IT instruction makes up to four following instructions conditional. The conditions can be all the same, or 
some of them can be the logical inverse of the others. The conditional instructions following the IT instruction 
form the IT block. 
The instructions in the IT block, including any branches, must specify the condition in the { cond} part of their 
syntax. 
Note: Your assembler might be able to generate the required IT instructions for conditional instructions automatically, 
so that you do not have to write them yourself. See your assembler documentation for details. 
A BKPT instruction in an IT block is always executed, even if its condition fails. 
Exceptions can be taken between an IT instruction and the corresponding IT block, or within an IT block. Such an 
exception results in entry to the appropriate exception handler, with suitable return information in LR and stacked 
PSR. 
Instructions designed for use for exception returns can be used as normal to return from the exception, and 
execution of the IT block resumes correctly. This is the only way that a PC-modifying instruction is permitted to 
branch to an instruction in an IT block. 
Restrictions 
The following instructions are not permitted in an IT block: 
° Ce. 
: CBZ and CBNZ. 
° CPSID and CPSIE. 
Other restrictions when using an IT block are: 
° A branch or any instruction that modifies the PC must either be outside an IT block or must be the last 
instruction inside the IT block. These are: 
— ADD PC, PC, Rm. 
— MOV PC, Rm. 
— B,BL, BX, BLX. 
- Any LDM, LDR, or POP instruction that writes to the PC. 
—  TBBand TBH. 
° Do not branch to any instruction inside an IT block, except when returning from an exception handler. 
° All conditional instructions except Bcond must be inside an IT block. Bcond can be either outside or inside 
an IT block but has a larger branch range if it is inside one. 
. Each instruction inside the IT block must specify a condition code suffix that is either the same or logical 
inverse as for the other instructions in the block. 
Note: Your assembler might place extra restrictions on the use of IT blocks, such as prohibiting the use of assembler 


directives within them. 


Condition flags 


This instruction does not change the flags. 
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ETTe NE 7 Next 3 Enstructions are conditional 
ANDNE RO, RO, R1 7 ANDNE does not update condition flags 
ADDSNE R2, R2, #1 7 ADDSNE updates condition flags 


























MOVEQ R2, R3 ; Conditional move 
CMP RO, #9 pECOnVcEe ROMmhexvaluc s(OMECr WS) eintomAS Cia 
; (0s =Vor "A'-'F!) 
ITE GT 7 Next 2 instructions are conditional 
ADDGT sul, 10), 55 ; Convert OxA -> 'A' 
ADDIE TR RO; 43 7 Convert Ox0—> 0) 
sage GT 7 if block with only one conditional tnstruct ton 
ADDGT Rl, Rl, #1 7 Increment Rl conditionally ITTEE EO 
7; Next 4 instructions are conditional 
MOVEQ RO, R1 ; Conditional move 
ADDE@ R2, R2, #10 ; Conditional add 
ANDNE R3, R3, #1 ; Conditional AND 
BNE.W dloop 7 Branch instruction can ionilly be used any the Wasit 
fF ANSE KCIE ale Gne in WIP lolloele 
alt NE ? Next Instruction is conditional 
ADD RO, TO), wel 7; Syntax errors no condition code used im IT block 
3.9.6 TBB and TBH 
Table Branch Byte and Table Branch Halfword. 
TBB [Rn, Rm] 
TBH [Rn, Rm, LSL #1] 
Where: 
Rn 
Is the register containing the address of the table of branch lengths. 
If Rn is PC, then the address of the table is the address of the byte immediately following the TBB or TBH 
instruction. 
Rm 


Is the index register. This contains an index into the table. For halfword tables, LSL #1 doubles the value in Rm 
to form the right offset into the table. 


Operation 


These instructions cause a PC-relative forward branch using a table of single byte offsets for TBB, or halfword 
offsets for TBH. Rn provides a pointer to the table, and Rm supplies an index into the table. For TBB the branch 
offset is the unsigned value of the byte returned from the table, and for TBH the branch offset is twice the 
unsigned value of the halfword returned from the table. The branch occurs to the address at that offset from the 
address of the byte immediately after the TBB or TBH instruction. 


Restrictions 


The restrictions are: 

° Rn must not be SP. 

° Rm must not be SP and must not be PC. 

. When any of these instructions is used inside an IT block, it must be the last instruction of the IT block. 


Condition flags 


These instructions do not change the flags. 
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ADR.W RO, BranchTable Byte 

TBB ex), aseil |] ; Rl is the index, RO is the base address of the 
; branch table 

Casel 

; an instruction sequence follows 

Case2 

; an instruction sequence follows 

Case3 

; an instruction sequence follows 

BranchTable Byte 


DCB 0 ; Casel offset calculation 
DCB ((Case2-Casel)/2) ; Case2 offset calculation 
DCB ((Case3-Casel)/2) ; Case3 offset calculation 
TBH [PC, Rl, LSL #1] ; Rl is the index, PC is used as base of the 


Pecconchmeaolic 

BranchTable H 

DCW ((CaseA - BranchTable H)/2) ; CaseA offset calculation 
DCW ((CaseB - BranchTable H)/2) ; CaseB offset calculation 
DCW ((CaseC - BranchTable H)/2) ; CaseC offset calculation 
CaseA 
; an instruction sequence follows 
CaseB 
; an instruction sequence follows 
CaseC 
; an instruction sequence follows 


3.10 Floating-point instructions 


This section provides the instruction set that the FPU uses. 
Table 41 shows the floating-point instructions. 


These instructions are only available if the FPU is included, and enabled, in the system. See Section 4.6.5 Code 
sequence for enabling the FPU for information about enabling the floating-point unit. 


Table 41. Floating-point instructions 


FLDMX (Decrement Before) loads multiple extension 
































FLDMDBX F ‘ : Section 3.10.1 FLDMDBX, FLDMIAX 
registers from consecutive memory locations 

FLDMIAX Phe X (Increment After) loads multiple extension Section 3.10.1 FLDMDBX, FLDMIAX 
registers from consecutive memory locations 

FSTMDBX Be: X (Decrement Befole) stores aultiple extension Section 3.10.2 FSTMDBX, FSTMIAX 
registers to consecutive memory locations 

FSTMIAX Ee X (Increment After) stores multiple extension Section 3.10.2 FSTMDBX, FSTMIAX 
registers to consecutive memory locations 

VABS Floating-point Absolute Section 3.10.3 VABS 

VADD Floating-point Add Section 3.10.4 VADD 

VCMP Compare two floating-point registers, or one floating-point Section 3.10.5 VCMP and VCMPE 
register and zero 

VCMPE Compare two floating-point registers, or one floating-point Section 3.10.5 VCMP and VCMPE 
register and zero with Invalid Operation check 

VCVT Convert between floating-point and integer oa =e Lol ane vGves pewenn 

floating-point and integer 
VCVT Convert between floating-point and fixed point cael he en pane Goatingspalnt 
and fixed-point 
hha ietane epee Float to integer conversion with directed roundin coe ves ak ee 
VCVTP, VCVTM g g and VCVTP 
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VCVTB 


VEVIR 





VCVIE 


VDIV 


VEMA 


VEMS 


VENMA 


VENMS 


= 
Cc 


DM 





< 
Cc 


DR 





Vi 
VMLA 
VM 


LS 


VMOV 


VMOV 


VMRS 











VPOP 





VPUSH 


VRINTA, 
VRINTN, 
VRINTP, VRIN!1 


AXNM, VMINNM 


rTM 





VRINTR, VRIN1 


VSEL 





VSORT 
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Converts half-precision value to single-precision 
Convert between floating-point and integer with rounding 


Converts single-precision register to half-precision 
Floating-point Divide 

Floating-point Fused Multiply Accumulate 
Floating-point Fused Multiply Subtract 
Floating-point Fused Negate Multiply Accumulate 
Floating-point Fused Negate Multiply Subtract 
Load Multiple extension registers 

Loads an extension register from memory 
Maximum, Minimum with IEEE754-2008 NaN handling 
Floating-point Multiply Accumulate 

Floating-point Multiply Subtract 

Floating-point Move Immediate 


Floating-point Move Register 


Copy Arm core register to single-precision 


Copy 2 Arm core registers to 2 single-precision 


Copies between Arm core register to scalar 


Copies between Scalar to Arm core register 


Move to Arm core register from floating-point System 
Register 


Move to floating-point System Register from Arm Core 
register 


Multiply floating-point 


Floating-point negate 


Floating-point multiply and add 


Floating-point multiply and subtract 


Floating-point multiply 
Pop extension registers 


Push extension registers 


Float to integer (in floating-point format) conversion with 
directed rounding 


Float to integer (in floating-point format) conversion 
Select register, alternative to a pair of conditional VMOV 


Floating-point square root 


Section 3.10.36 VCVTB and VCVTT 


Section 3.10.6 VCVT and VCVTR between 
floating-point and integer 


Section 3.10.36 VCVTB and VCVTT 


Section 3.10.8 VDIV 


Section 3.10.9 VFMA and VFMS 


Section 3.10.9 VFMA and VFMS 


Section 3.10.10 VFNMA and VFNMS 


Section 3.10.10 VFNMA and VFNMS 


Section 3.10.11 VLDM 


Section 3.10.12 VLDR 


Section 3.10.37 VMAXNM and VMINNM 


Section 3.10.15 VMLA and VMLS 


Section 3.10.15 VMLA and VMLS 


Section 3.10.16 VMOV Immediate 


Section 3.10.17 VMOV Register 


Section 3.10.19 
single-precision 


VMOV core register to 


Section 3.10.20 VMOV two core registers to 
two single-precision registers 


Section 3.10.22 VMOV core register to 
scalar 


Section 3.10.18 VMOV scalar to core 


register 


Section 3.10.23 VMRS 


Section 3.10.24 VMSR 


Section 3.10.25 VMUL 


Section 3.10.26 VNEG 


Section 3.10.27 


VNMUL 


VNMLA, VNMLS and 


Section 3.10.27 


VNMUL 


VNMLA, VNMLS and 


Section 3.10.27 


VNMUL 


VNMLA, VNMLS and 


Section 3.10.28 VPOP 


Section 3.10.29 VPUSH 


Section 3.10.39 VRINTA, VRINTN, VRINTP, 
VRINTM, and VRINTZ 


Section 3.10.38 VRINTR and VRINTX 
Section 3.10.34 VSEL 
Section 3.10.30 VSQRT 
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VSTM Store Multiple extension registers Section 3.10.31 VSTM 

VSTR Stores an extension register to memory Section 3.10.32 VSTR 

VSUB Floating-point Subtract Section 3.10.33 VSUB 
3.10.1 FLDMDBX, FLDMIAX 


FLDMx (Decrement Before, Increment After) loads multiple extension registers from consecutive memory 
ocations using an address from a general-purpose register. 


FLDMDBX{cond} Rn!, dreglist 
FLDMIAX{cond} Rn{!}, dreglist 








Where: 
cond 
Is an optional condition code. 
Rn 
Is the base register. If write-back is not specified, the PC can be used. 
! 
Specifies base register write-back. 
dreglist 
Is the list of consecutively numbered 64-bit SIMD and FP registers to be transferred. The list must contain at 
least one register, all registers must be in the range DO-D15, and must not contain more than 16 registers. 
Operation 
FLDMX loads multiple SIMD and FP registers from consecutive locations in the Advanced SIMD and floating-point 
register file using an address from a general-purpose register. 
Arm deprecates use of FLDMDBX and FLDMIAX, except for disassembly purposes, and reassembly of 
disassembled code. 
Depending on settings in the CPACR and NSACR and the Security state and mode in which the instruction is 
executed, an attempt to execute the instruction might be undefined. 
3.10.2 FSTMDBX, FSTMIAX 
FSTMX (Decrement Before, Increment After) stores multiple extension registers to consecutive memory locations 
using an address from a general-purpose register. 
FSTMDBX{c}{q} Rn!, dreglist 
FSTMIAX{c}{q} Rn{!}, dreglist 
Where: 
cond 
Is an optional condition code. 
Rn 
Is the base register. If write-back is not specified, the PC can be used. However, Arm deprecates use of the PC. 
! 
Specifies base register write-back. 
dreglist 


Is the list FP registers to be transferred. The list must contain at least one register, all registers must be in the 
range DO-D15, and must not contain more than 16 registers. 
Operation 


FSTMX stores multiple SIMD and FP registers from the Advanced SIMD and floating-point register file to 
consecutive locations using an address from a general-purpose register. 
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Arm deprecates use of FLDMDBX and FLDMIAX, except for disassembly purposes, and reassembly of 
disassembled code. 


Depending on settings in the CPACR, NSACR, and FPEXC Registers, and the security state and mode in which 
the instruction is executed, an attempt to execute the instruction might be undefined. 


3.10.3 VABS 
Floating-point Absolute. 
VABS{cond}.F32 Sd, Sm 


Where: 
cond 
Is an optional condition code. 
Sd, Sm 
Are the destination floating-point value and the operand floating-point value. 
Operation 
This instruction: 
1. Takes the absolute value of the operand floating-point register. 
2. Places the results in the destination floating-point register. 
Restrictions 
There are no restrictions. 
Condition flags 
This instruction does not change the flags. 
VABS.F32 S4, S6 
3.10.4 VADD 
Floating-point Add. 
VADD{conad}.F32 {Sd,} Sn, Sm 
Where: 
cond 
Is an optional condition code. 
Sd 
Is the destination floating-point value. 
Sn, Sm 


Are the operand floating-point values. 


Operation 


This instruction: 

1. Adds the values in the two floating-point operand registers. 
2. Places the results in the destination floating-point register. 
3. the results in the destination floating-point register. 
Restrictions 


There are no restrictions. 


Condition flags 


This instruction does not change the flags. 
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VEDD.ES2 64, 86, 37 
3.10.5 VCMP and VCMPE 


Compares two floating-point registers, or one floating-point register and zero. 


VCMP{E}{ cond}.F32 Sd, Sm| #0.0 
VCMP{E}{ cond}.F32 Sd, #0.0 


Where: 
cond 
Is an optional condition code. 
E 
If present, any NaN operand causes an Invalid Operation exception. Otherwise, only a signaling NaN 
causes the exception. 
Sd 
Is the floating-point operand to compare. 
Sm|Dm 
Is the floating-point operand that is compared with. 
Operation 
This instruction: 
1. Compares either: 
— Two floating-point registers. 
- Or one floating-point register and zero. 
2. Writes the result to the FPSCR flags. 
Restrictions 
This instruction can optionally raise an Invalid Operation exception if either operand is any type of NaN. It 
always raises an Invalid Operation exception if either operand is a signaling NaN. 
Condition flags 
When this instruction writes the result to the FPSCR flags, the values are normally transferred to the Arm flags by 
a subsequent vMRS instruction. 
VCMP.F32 S4, #0.0VCMP.F32 sa, Se 
3.10.6 VCVT and VCVTR between floating-point and integer 
Converts a value in a register from floating-point to and from a 32-bit integer. 
VCVT{R}{ cond}. Tm.F32 Sd, Sm 
VCVT{cond}.F32.Tm Sd, Sm 
Where: 
R 
If R is specified, the operation uses the rounding mode specified by the FPSCR. If R is omitted. the operation 
uses the Round towards Zero rounding mode. 
cond 


Is an optional condition code. 


PM0264 - Rev 1 page 132/245 





<] 


PM0264 


Floating-point instructions 





Sd, Sm 


3.10.7 


cond 


Td 


Sd 


fbits 
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Is the data type for the operand. It must be one of: 
° $32 signed 32-bit value. 
° U32 unsigned 32-bit value. 


Are the destination register and the operand register. 


Operation 


These instructions: 
1. Either: 
— Convert a value in a register from floating-point value to a 32-bit integer. 
— Convert from a 32-bit integer to floating-point value. 
2. Place the result in a second register. 
The floating-point to integer operation normally uses the Round towards Zero rounding mode, but can 
optionally use the rounding mode specified by the FPSCR. 


The integer to floating-point operation uses the rounding mode specified by the FPSCR. 
Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 


VCVT between floating-point and fixed-point 

Converts a value in a register from floating-point to and from a 32-bit integer. 
VCVT{cond}.Td.F32 Sd, Sd, #fbits 

VCVT{cond}.F32.Td Sd, Sd, #fbits 

Where: 


Is an optional condition code. 


Is the data type for the fixed-point number. It must be one of: 
° S16 signed 16-bit value. 

° U16 Unsigned 16-bit value. 

° $32 signed 32-bit value. 

° U32 unsigned 32-bit value. 


Is the destination register and the operand register. 


Is the number of fraction bits in the fixed-point number: 

. If Tdis S16 or U16, fbits must be in the range 0-16. 

° If Tdis S32 or U32, fbits must be in the range 1-32. 
Operation 


This instruction: 
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1. Either 
— Converts a value in a register from floating-point to fixed-point. 
— Converts a value in a register from fixed-point to floating-point. 
2. Places the result in a second register. 
The floating-point values are single-precision or double-precision. 


The fixed-point value can be 16-bit or 32-bit. Conversions from fixed-point values take their operand from the low- 
order bits of the source register and ignore any remaining bits. 


Signed conversions to fixed-point values sign-extend the result value to the destination register width. 
Unsigned conversions to fixed-point values zero-extend the result value to the destination register width. 


The floating-point to fixed-point operation uses the Round towards Zero rounding mode. The fixed-point to 
floating-point operation uses the Round to Nearest rounding mode. 


Restrictions 


There are no restrictions. 


Condition flags 

These instructions do not change the flags. 
3.10.8 VDIV 

Divides floating-point values. 

VDIV{cond}.F32 {Sd,} Sn, Sm 


Where: 
cond 
Is an optional condition code. 
Sd 
Is the destination register. 
Sn, Sm 


Are the operand registers. 


Operation 


This instruction: 
1. Divides one floating-point value by another floating-point value. 
2. Writes the result to the floating-point destination register. 


Restrictions 


There are no restrictions. 


Condition flags 


These instructions do not change the flags. 


3.10.9 VFMA and VFMS 
Floating-point Fused Multiply Accumulate and Subtract. 
VFMA{cond}.F32 {Sd,} Sn, Sm 
VFMS{cond}.F32 {Sd,} Sn, Sm 
Where: 
cond 


Is an optional condition code. 
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Is the destination register. 
Sn, Sm 


Are the operand registers. 


Operation 


The VFMA instruction: 

1. | Multiplies the floating-point values in the operand registers. 

2. _Accumulates the results into the destination register. 

The result of the multiply is not rounded before the accumulation. 

The VFMs instruction: 

1. Negates the first operand register. 

2.  Multiplies the floating-point values of the first and second operand registers. 
3. Adds the products to the destination register. 

4. Places the results in the destination register. 

The result of the multiply is not rounded before the addition. 


Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 
3.10.10 VFNMA and VFNMS 


Floating-point Fused Negate Multiply Accumulate and Subtract. 


VFNMA{conad}.F32 {Sd,} Sn, Sm 
VFNMS{cona}.F32 {Sd,} Sn, Sm 


Where: 
cond 
Is an optional condition code. 
Sd 
Is the destination register. 
Sn, Sm 


Are the operand registers. 


Operation 


The VFNMA instruction: 

1. Negates the first floating-point operand register. 

2.  Multiplies the first floating-point operand with second floating-point operand. 
3. Adds the negation of the floating -point destination register to the product 

4. Places the result into the destination register. 

The result of the multiply is not rounded before the addition. 

The VFNMS instruction: 

1. | Multiplies the first floating-point operand with second floating-point operand. 
2. Adds the negation of the floating-point value in the destination register to the product. 
3. Places the result in the destination register. 

The result of the multiply is not rounded before the addition. 
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Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 


3.10.11 VLDM 
Floating-point Load Multiple. 
VLDM{mode}{cond}{.size} Rn{!}, list 


Where: 
mode 


Is the addressing mode: 
IA 


Increment after. The consecutive addresses start at the address specified in Rn. 
DB 


Decrement before. The consecutive addresses end before 
the address specified in Rn. 


cond 
Is an optional condition code. 
size 
Is an optional data size specifier. 
Rn 
Is the base register. The SP can be used. 
! 
Is the command to the instruction to write a modified value back to Rn. This is required if mode == DB, and is 
optional if mode == IA. 
list 


Is the list of extension registers to be loaded, as a list of consecutively numbered doubleword or singleword 
registers, separated by commas and surrounded by brackets. 


Operation 


This instruction loads multiple extension registers from consecutive memory locations using an address from an 
Arm core register as the base address. 


Restrictions 


The restrictions are: 

° If size is present, it must be equal to the size in bits, 32 or 64, of the registers in list. 

. For the base address, the SP can be used. In the Arm instruction set, if / is not specified the Pc can be 
used. 

. list must contain at least one register. If it contains doubleword registers, it must not contain more than 16 
registers. 

° If using the Decrement before addressing mode, the write back flag, !, must be appended to the base 
register specification. 





Condition flags 


These instructions do not change the flags. 
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VLDMIA.F64 rl, {d3,d4,d5} 


3.10.12 VLDR 
Loads a single extension register from memory. 
VLDR{cond}{. F<32|64>} <Sd| Dd>, [Rn {, #imm}] 
VLDR{cond}{. F<32|64>} <Sd| Dd>, label 
VLDR{cond}{. F< 32|64>} <Sd| Da>, [PC, #imn] 


Where: 
cond 
Is an optional condition code. 
32, 64 
Are the optional data size specifiers. 
Dd 
Is the destination register for a doubleword load. 
Sd 
Is the destination register for a singleword load. 
Rn 
Is the base register. The SP can be used. 
imm 
Is the + or - immediate offset used to form the address. Permitted address values are multiples of 4 in the range 
0-1020. 
label 


Is the label of the literal data item to be loaded. 


Operation 


This instruction loads a single extension register from memory, using a base address from an Arm core register, 
with an optional offset. 


Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 
3.10.13 VLLDM 


Floating-point Lazy Load Multiple restores the contents of the Secure floating-point registers that were protected 
by a VLS™™ instruction, and marks the floating-point context as active. 


VLLDM {cond}<Rn> 
Where: 
cond 
Is an optional condition code. 
Rn 


Is the base register. 
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Operation 


If the lazy state preservation set up by a previous VLSTM instruction is active (FPCCR.LSPACT == 1), this 
instruction deactivates lazy state preservation and enables access to the Secure floating-point registers. If lazy 
state preservation is inactive (FPCCR.LSPACT == 0), either because lazy state preservation was not enabled 
(FPCCR.LSPEN == 0) or because a floating-point instruction caused the Secure floating-point register contents to 
be stored to memory, this instruction loads the stored Secure floating-point register contents back into the floating- 
point registers. If Secure floating-point is not in use (CONTROL_S.SFPA == 0), this instruction behaves as a NOP. 
This instruction is only available in Secure state, and is UNDEFINED in Non-secure state. If the Floating-point 
Extension is not implemented, this instruction is available in Secure state, but behaves as a NOP. 


Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 


3.10.14 VLSTM 


Floating-point Lazy Store Multiple stores the contents of Secure floating-point registers to a prepared stack frame, 
and clears the Secure floating-point registers. 


VLSTM {cona}<Rn> 
Where: 
cond 
Is an optional condition code. 
Rn 


Is the base register. 


Operation 


If floating-point lazy preservation is enabled (FRCCR.LSPEN == 1), then the next time a floating-point instruction 
other than VLSTM or VLLDM is executed: 


° The contents of Secure floating-point registers are stored to memory. 
° The Secure floating-point registers are cleared. 


If Secure floating-point is not in use (CONTROL_S.SFPA == 0), this instruction behaves as a NOP. 
This instruction is only available in Secure state, and is UNDEFINED in Non-secure state. 
If the Floating-point Extension is not implemented, this instruction is available in Secure state, but behaves as a 


NOP. 
Restrictions 


There are no restrictions. 


Condition flags 


These instructions do not change the flags. 


3.10.15 VMLA and VMLS 
Multiplies two floating-point values, and accumulates or subtracts the result. 
VMLA{conad}.F32 Sd, Sn, Sm 
VMLS{cona}.F32 Sd, Sn, Sm 


Where: 
cond 


Is an optional condition code. 
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Is the destination floating-point value. 
Sn, Sm 


Are the operand floating-point values. 


Operation 


The floating-point Multiply Accumulate instruction: 

1. Multiplies two floating-point values. 

2. Adds the results to the destination floating-point value. 

The floating-point Multiply Subtract instruction: 

1. Multiplies two floating-point values. 

2.  Subtracts the products from the destination floating-point value. 
3. Places the results in the destination register. 


Restrictions 


There are no restrictions. 


Condition flags 

These instructions do not change the flags. 
3.10.16 VMOV Immediate 

Move floating-point Immediate. 

VMOV{cond}.F32 Sd, #imm 


Where: 
cond 
Is an optional condition code. 
Sd 
Is the destination register. 
imm 


Is a floating-point constant. 


Operation 


This instruction copies a constant value to a floating-point register. 


Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 


3.10.17 VMOV Register 
Copies the contents of one register to another. 
VMOV{cond}.F<32> Sd, Sm Dm 


Where: 
cond 


Is an optional condition code. 
Dd 


Is the destination register, for a doubleword operation. 
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Dm 

Is the source register, for a doubleword operation. 
Sd 

Is the destination register, for a singleword operation. 
sm 


Is the source register, for a singleword operation. 


Operation 


This instruction copies the contents of one floating-point register to another. 


Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 
3.10.18 VMOV scalar to core register 
Transfers one word of a doubleword floating-point register to an Arm core register. 
VMOV{cond} Rt, Dn[x] 


Where: 

cond 

Is an optional condition code. 
Rt 

Is the destination Arm core register. 
Dn 

Is the 64-bit doubleword register. 
x 


Specifies which half of the doubleword register to use: 
° If x is 0, use lower half of doubleword register. 
° If x is 1, use upper half of doubleword register. 


Operation 

This instruction transfers one word from the upper or lower half of a doubleword floating-point register to an Arm 
core register. 

Restrictions 


Rt cannot be PC or SP. 


Condition flags 


These instructions do not change the flags. 


3.10.19 VMOV core register to single-precision 
Transfers a single-precision register to and from an Arm core register. 
VMOV{cona} Sn, Rt 
VMOV{cond} Rt, Sn 
Where: 
cond 


Is an optional condition code. 
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<Sn> 
Is the single-precision floating-point register. 
Rt 
Is the Arm core register. 
Operation 
This instruction transfers: 
° The contents of a single-precision register to an Arm core register. 
° The contents of an Arm core register to a single-precision register. 
Restrictions 
Rt cannot be PC or SP. 
Condition flags 
These instructions do not change the flags. 

3.10.20 VMOV two core registers to two single-precision registers 
Transfers two consecutively numbered single-precision registers to and from two Arm core registers. 
VMOV{cond} Sm, Sm1, Rt, Rt2 
VMOV{cond} Rt, Rt2, Sm, Sm1 
Where: 

cond 

Is an optional condition code. 
sm 
Is the first single-precision register. 
Sm1 
Is the second single-precision register. This is the next single-precision register after Sm. 
Rt 
Is the Arm core register that Sm is transferred to or from. 
Rt2 


Is the Arm core register that Sm1 is transferred to or from. 


Operation 


This instruction transfers: 
° The contents of two consecutively numbered single-precision registers to two Arm core registers. 
° The contents of two Arm core registers to a pair of single-precision registers. 


Restrictions 


The restrictions are: 

. The floating-point registers must be contiguous, one after the other. 
. The Arm core registers do not have to be contiguous. 

. Rt cannot be PC or SP. 


Condition flags 


These instructions do not change the flags. 
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3.10.21 VMOV two core registers and a double-precision register 


Transfers two words from two Arm core registers to a doubleword register, or from a doubleword register to two 
Arm core registers. 


VMOV{conda} Dm, Rt, Rt2 
VMOV{cond} Rt, Rt2, Dm 


Where: 
cond 
Is an optional condition code. 
Dm 
Is the double-precision register. 
Rt, Rt2 


Are the two Arm core registers. 


Operation 

This instruction: 

° Transfers two words from two Arm core registers to a doubleword register. 
° Transfers a doubleword register to two Arm core registers. 

Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 
3.10.22 VMOV core register to scalar 


Transfers one word to a floating-point register from an Arm core register. 
VMOV{ cond\{. 32} Dax], Rt 


Where: 
cond 
Is an optional condition code. 
32 
Is an optional data size specifier. 
Dad{[x] 
Is the destination, where [x] defines which half of the doubleword is transferred, as follows: 
° If x is 0, the lower half is extracted. 
° If x is 1, the upper half is extracted. 
Rt 


Is the source Arm core register. 


Operation 


This instruction transfers one word to the upper or lower half of a doubleword floating-point register from an Arm 
core register. 


Restrictions 


Rt cannot be PC or SP. 
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3.10.23 


cond 


Rt 


APSR_nzcv 


3.10.24 


cond 


Rt 


3.10.25 
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Condition flags 
These instructions do not change the flags. 
VMRS 


Move to Arm Core register from floating-point System Register. 


VMRS{conqd} Rt, FPSCR 
VMRS{conqa} APSR_nzcv, FPSCR 
Where: 


Is an optional condition code. 


Is the destination Arm core register. This register can be RO-R14. 


Transfer floating-point flags to the APSR flags. 


Operation 

This instruction performs one of the following actions: 

. Copies the value of the FPSCR to a general-purpose register. 

° Copies the value of the FPSCR flag bits to the APSR N, Z, C, and V flags. 
Restrictions 


Rt cannot be PC or SP. 


Condition flags 

These instructions optionally change the N, Z, C, and V flags. 
VMSR 

Move to floating-point System Register from Arm Core register. 


VMSR{cond} FPSCR, Rt 
Where: 


Is an optional condition code. 


Is the general-purpose register to be transferred to the FPSCR. 


Operation 


This instruction moves the value of a general-purpose register to the FPSCR. 


Restrictions 


Rt cannot be PC or SP. 


Condition flags 

This instruction updates the FPSCR. 
VMUL 

Floating-point Multiply. 
VMUL{cond}.F32 {Sd,} Sn, Sm 
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Where: 
cond 
Is an optional condition code. 
Sd 
Is the destination floating-point value. 
Sn, Sm 


Are the operand floating-point values. 


Operation 

This instruction: 

1. | Multiplies two floating-point values. 

2. Places the results in the destination register. 
Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 
3.10.26 VNEG 


Floating-point Negate. 
VNEG{cona}.F32 Sd, Sm 


Where: 
cond 
Is an optional condition code. 
Sd 
Is the destination floating-point value. 
sm 


Is the operand floating-point value. 


Operation 


This instruction: 

1. Negates a floating-point value. 

2. Places the results in a second floating-point register. 
The floating-point instruction inverts the sign bit. 


Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 


3.10.27 VNMLA, VNMLS and VNMUL 
Floating-point multiply with negation followed by add or subtract. 
VNMLA{cond}.F32 Sd, Sn, Sm 
VNMLS{cond}.F32 Sd, Sn, Sm 
VNMUL{cond}.F32 {Sd,} Sn, Sm 
Where: 
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cond 

Is an optional condition code. 
Sd 

Is the destination floating-point register. 
Sn, Sm 


Are the operand floating-point registers. 


Operation 


The VNMLA instruction: 

1. | Multiplies two floating-point register values. 

2. Adds the negation of the floating-point value in the destination register to the negation of the product. 
3. Writes the result back to the destination register. 

The VNMLS instruction: 

1. Multiplies two floating-point register values. 

2. Adds the negation of the floating-point value in the destination register to the product. 
3. | Writes the result back to the destination register. 

The VNMUL instruction: 

1.  Multiplies together two floating-point register values. 

2. Writes the negation of the result to the destination register. 


Restrictions 


There are no restrictions. 


Condition flags 

These instructions do not change the flags. 
3.10.28 VPOP 

Floating-point extension register Pop. 

VPOP{cond}{.size} list 


Where: 
cond 
Is an optional condition code. 
size 
Is an optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers in list. 
list 


Is a list of extension registers to be loaded, as a list of consecutively numbered doubleword or singleword 
registers, separated by commas and surrounded by brackets. 


Operation 


This instruction loads multiple consecutive extension registers from the stack. 


Restrictions 


list must contain at least one register, and not more than sixteen registers. 


Condition flags 


These instructions do not change the flags. 
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3.10.29 


cond 


size 


list 


3.10.30 


cond 


Sd 


Sm 


3.10.31 
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VPUSH 
Floating-point extension register Push. 


VPUSH{cond}{.size} list 
Where: 


Is an optional condition code. 


Is an optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers in list. 


Is a list of the extension registers to be stored, as a list of consecutively numbered doubleword or singleword 
registers, separated by commas and surrounded by brackets. 


Operation 


This instruction stores multiple consecutive extension registers to the stack. 


Restrictions 


list must contain at least one register, and not more than sixteen. 


Condition flags 

These instructions do not change the flags. 
VSQRT 

Floating-point Square Root. 


VSQRT{cond}.F32 Sd, Sm 
Where: 


Is an optional condition code. 


Is the destination floating-point value. 


Is the operand floating-point value. 


Operation 

This instruction: 

° Calculates the square root of the value in a floating-point register. 
° Writes the result to another floating-point register. 

Restrictions 


There are no restrictions. 


Condition flags 

These instructions do not change the flags. 
VSTM 

Floating-point Store Multiple. 


VSTM{mode}{cond}{.size} Rn{!}, list 
Where: 
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mode 


cond 


size 


Rn 


list 


3.10.32 


cond 


32, 64 


Sd 


Dd 


Rn 
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Is the addressing mode: 


. IA Increment After. The consecutive addresses start at the address specified in Rn. This is the default and 
can be omitted. 


° DB Decrement Before. The consecutive addresses end just before the address specified in Rn. 


Is an optional condition code. 

Is an optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers in list. 
Is the base register. The SP can be used. 

Is the function that causes the instruction to write a modified value back to Rn. Required if mode == DB. 

Is a list of the extension registers to be stored, as a list of consecutively numbered doubleword or singleword 


registers, separated by commas and surrounded by brackets. 


Operation 


This instruction stores multiple extension registers to consecutive memory locations using a base address from an 
Arm core register. 


Restrictions 


The restrictions are: 


. list must contain at least one register. If it contains doubleword registers it must not contain more than 16 
registers. 


. Use of the PC as Rn is deprecated. 


Condition flags 
These instructions do not change the flags. 


VSTR 
Floating-point Store. 
VSTR{cond{. 32} Sd, [Rn{, #imm}] 
VSTR{cond}{. 64} Da, [Rn{, #imm}] 
Where: 
Is an optional condition code. 
Are the optional data size specifiers. 
Is the source register for a singleword store. 


Is the source register for a doubleword store. 


Is the base register. The SP can be used. 
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imm 
Is the + or - immediate offset used to form the address. Values are multiples of 4 in the range 0-1020. imm can 
be omitted, meaning an offset of +0. 
Operation 


This instruction stores a single extension register to memory, using an address from an Arm core register, with an 
optional offset, defined in imm: 


Restrictions 


The use of PC for Rn is deprecated. 


Condition flags 
These instructions do not change the flags. 
3.10.33 VSUB 


Floating-point Subtract. 
VSUB{conad}.F32 {Sd,} Sn, Sm 


Where: 
cond 
Is an optional condition code. 
Sd 
Is the destination floating-point value. 
Sn, Sm 


Are the operand floating-point values. 


Operation 

This instruction: 

1. Subtracts one floating-point value from another floating-point value. 
2. Places the results in the destination floating-point register. 
Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 


3.10.34 VSEL 


Floating-point Conditional Select allows the destination register to take the value from either one or the other of 
two source registers according to the condition codes in the APSR. 


VSEL{cond}.F32 Sd, Sn, Sm 


Where: 
cond 
Is an optional condition code. VSEL has a subset of the condition codes. The condition codes for VSEL are 
limited to GE, GT, EQ and VS, with the effect that LT, LE, NE and VC is achievable by exchanging the source 
operands. 
Sd 
Is the destination single-precision floating-point value. 
Sn, Sm 


Are the operand single-precision floating-point values. 


PM0264 - Rev 1 page 148/245 





‘] 


PM0264 


Floating-point instructions 





3.10.35 


Sd 


Sm, 


<rmode> 


A 


Operation 


Depending on the result of the condition code, this instruction moves either: 


. Sn source register to the destination register. 
. Sm source register to the destination register. 


The behavior is: 


EncodingSpecificOperations (); 
ExecuteFPCheck () ; 


aie Glo @jeirercal@im ielaein 
S[d] = if ConditionHolds(cond) then S[n] else S[m]; 


Restrictions 


The VSEL instruction must not occur inside an IT block. 
Condition flags 
This instruction does not change the flags. 


VCVTA, VCVTM VCVTN, and VCVTP 
Floating-point to integer conversion with directed rounding. 
VCVT <rmode>.$32.F32 Sd, Sm 


VCVT <rmode>.U32.F32 Sd, Sm 
Where: 
Is the destination single-precision or double-precision floating-point value. 


Are the operand single-precision or double-precision floating-point values. 


Is one of: 


Round to nearest ties away. 


M 


Round to nearest even. 


N 


Round towards plus infinity. 


P 


Round towards minus infinity. 
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Operation 


These instructions: 

1. Read the source register. 

2. Convert to integer with directed rounding. 
3. Write to the destination register. 


Restrictions 


There are no restrictions. 
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Condition flags 
These instructions do not change the flags. 


3.10.36 VCVTB and VCVTT 


Converts between half-precision and single-precision without intermediate rounding. 
VCVT{y}{cond}.F32.F16 Sd, Sm 
VCVT{y}{conad}.F16.F32 sd, Sm 


Where: 
y 
Specifies which half of the operand register Sm or destination register Sd is used for the operand or destination: 
° If y is B, then the bottom half, bits [15:0], of Sm or Sd is used. 
° If yis T, then the top half, bits [31:16], of Sm or Sdis used. 
cond 
Is an optional condition code. 
Sd 
Is the destination register. 
sm 


Is the operand register. 


Operation 


This instruction with the .F16.F32 suffix: 


1. Converts the half-precision value in the top or bottom half of a single-precision register to single-precision 
value. 


2. Writes the result to a single-precision register. 

This instruction with the .F32.F16 suffix: 

1. Converts the value in a single-precision register to half-precision value. 

2. Writes the result into the top or bottom half of a single-precision register, preserving the other half of the 


target register. 
Restrictions 


There are no restrictions. 


Condition flags 


These instructions do not change the flags. 


3.10.37 VMAXNM and VMINNM 


Return the minimum or the maximum of two floating-point numbers with NaN handling as specified by 
IEEE754-2008. 
VMAXNM.F32 Sd, Sn, Sm 
VMINNM.F32 Sd, Sn, Sm 
Where: 
Sd 
Is the destination single-precision floating-point value. 
Sn, Sm 


Are the operand single-precision floating-point values. 
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3.10.38 


cond 


Sd 


Sm 


3.10.39 


Sd 


Sm 
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Operation 


The VMAXNM instruction compares two source registers, and moves the largest to the destination register. 
The VMINNM instruction compares two source registers, and moves the smallest to the destination register. 


Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 


VRINTR and VRINTX 


Round a floating-point value to an integer in floating-point format. 
VRINT{R,X}{cona}.F32 Sd, Sm 
Where: 


Is an optional condition code. 
Is the destination floating-point value. 


Are the operand floating-point values. 


Operation 


These instructions: 
1. Read the source register. 


2. Round to the nearest integer value in floating-point format using the rounding mode specified by the FPSCR. 
A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same 
sign, and a NaN is propagated as for normal arithmetic. 


3. Write the result to the destination register. 

4. For the VRINTX instruction only. Generate a floating-point exception if the result is not numerically equal to 
the input value. 

Restrictions 


There are no restrictions. 
Condition flags 
These instructions do not change the flags. 


VRINTA, VRINTN, VRINTP, VRINTM, and VRINTZ 


Round a floating-point value to an integer in floating-point format using directed rounding. 
VRINT <rmode>.F32 Sd, Sm 
Where: 


Is the destination single-precision floating-point value. 


Are the operand single-precision floating-point values. 
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<rmode> 


Is one of: 
A 


Round to nearest ties away. 
N 


Round to Nearest Even. 
P 


Round towards Plus Infinity. 
M 


Round towards Minus Infinity. 
Z 


Round towards Zero. 


Operation 


These instructions: 
1. Read the source register. 
2. Round to the nearest integer value with a directed rounding mode specified by the instruction. 


3. A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same 
sign, and a NaN is propagated as for normal arithmetic. 


4. Write the result to the destination register. 


Restrictions 


VRINTA, VRINTN, VRINTP and VRINTM cannot be conditional. VRINTZ can be conditional. 


Condition flags 


These instructions do not change the flags. 
3.11 Miscellaneous instructions 


Table 42 shows the remaining Cortex®-M33 instructions: . 


Table 42. Miscellaneous instructions 











BKPT Breakpoint Section 3.11.1 BKPT 
CPSID Change Processor State, Disable Interrupts Section 3.11.2 CPS 
CPSIE Change Processor State, Enable Interrupts Section 3.11.2 CPS 
DMB Data Memory Barrier Section 3.11.4 DMB 
DSB Data Synchronization Barrier Section 3.11.5 DSB 
ISB Instruction Synchronization Barrier Section 3.11.6 ISB 
RS Move from special register to register Section 3.11.7 MRS 
SR Move from register to special register Section 3.11.8 MSR 
NOP No Operation Section 3.11.9 NOP 
SEV Send Event Section 3.11.10 SEV 
SG Secure Gateway Section 3.11.11 SG 
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Supervisor Call Section 3.11.12 S$ 
fldl Test Target Section 3.11.13 TT, TTT, TTA, and TTAT 
flake Test Target Unprivileged Section 3.11.13 TT, TTT, TTA, and TTAT 
TTA Test Target Alternate Domain Section 3.11.13 TT, TTT, TTA, and TTAT 
TTAT Test Target Alternate Domain Unprivileged Section 3.11.13 TT, TTT, TTA, and TTAT 
WEE Wait For Event Section 3.11.15 WFE 
WEI Wait For Interrupt Section 3.11.16 WEI 
YIELD Yield Section 3.11.17 YIELD 
:11:1 BKPT 
Breakpoint. 
BKPT #imm 
Where: 
imm 


Is an expression evaluating to an integer in the range 0-255 (8-bit value). 


Operation 


The BKPT instruction causes the processor to enter Debug state if invasive debug is enabled. Debug tools can 
use this to investigate system state when the instruction at a particular address is reached. 


imm is ignored by the processor. If required, a debugger can use it to store additional information about the 
breakpoint. 

The BKPT instruction can be placed inside an IT block, but it executes unconditionally, unaffected by the condition 
specified by the IT instruction. 


Condition flags 


This instruction does not change the flags. 


BKPT #0x3 ; Breakpoint with immediate value set to 0x3 (debugger can 
7; extract the immediate value by locating it using the PC) 


Note: Arm does not recommend the use of the BKPT instruction with an immediate value set to OxAB for any purpose 
other than Semi-hosting. 
3.11.2 CPS 


Change Processor State. 


CPSeffect iflags 
Where: 
effect 


Is one of: 
IE 


Clears the special purpose register. 
ID 


Sets the special purpose register. 
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iflags 
Is a sequence of one or more flags: 
a 
Set or clear PRIMASK. 
£ 
Set or clear FAULTMASK. 
Operation 
CPS changes the PRIMASK and FAULTMASK special register values. 
Restrictions 
The restrictions are: 
. Use CPS only from privileged software. It has no effect if used in unprivileged software. 
° CPS cannot be conditional and so must not be used inside an IT block. 
Condition flags 
This instruction does not change the condition flags. 
CPSID i 7 Disable interrupts and configurable fault handlers (set PRIMASK) 
CPSID £ 7; Disable interrupts and all fault handlers {set FAULTMASK) 
CPSIE i ; Enable interrupts and configurable fault handlers (clear PRIMASK) 
CPSIE £ ; Enable interrupts and fault handlers (clear FAULTMASK) 
3.11.3 CPY 
Copy is a pre-Unified Assembler Language (UAL) synonym for MOV (register). 
CPY Rd, Rn 
This is equivalent to: 
MOV Ra, Rn 
3.11.4 DMB 
Data Memory Barrier. 
DMB{cona} {opt} 
Where: 
cond 
Is an optional condition code. 
opt 
Specifies an optional limitation on the DMB operation. Values are: 
SY 


DMB operation ensures ordering of all accesses, encoded as opt == '1111'. Can be omitted. 


All other encodings of opt are reserved. The corresponding instructions execute as system (SY) DMB operations, 
but software must not rely on this behavior. 


Operation 


DMB acts as a data memory barrier. It ensures that all explicit memory accesses that appear, in program order, 
before the DMB instruction are completed before any explicit memory accesses that appear, in program order, 
after the DMB instruction. DMB does not affect the ordering or execution of instructions that do not access memory. 


Condition flags 


This instruction does not change the flags. 
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DMB ; Data Memory Barrier 


3.11.5 DSB 
Data Synchronization Barrier. 
DSB{cond} {opt} 
Where: 

cond 


Is an optional condition code. 
opt 

Specifies an optional limitation on the DSB operation. Values are: 
SY 


DSB operation ensures completion of all accesses, encoded as opt == '1111'. Can be omitted. 


All other encodings of opt are reserved. The corresponding instructions execute as system (SY) DSB operations, 
but software must not rely on this behavior. 


Operation 


DSB acts as a special data synchronization memory barrier. Instructions that come after the DSB, in program 
order, do not execute until the DSB instruction completes. The DSB instruction completes when all explicit memory 
accesses before it complete. 

Condition flags 


This instruction does not change the flags. 


DSB ; Data Synchronisation Barrier 


3.11.6 ISB 
Instruction Synchronization Barrier. 
ISB{conad} {opt} 
Where: 

cond 


Is an optional condition code. 
opt 

Specifies an optional limitation on the ISB operation. Values are: 
SY 


Fully system ISB operation, encoded as opt == '1111'. Can be omitted. 


All other encodings of opt are reserved. The corresponding instructions execute as full system ISB operations, 
but software must not rely on this behavior. 


Operation 


ISB acts as an instruction synchronization barrier. It flushes the pipeline of the processor, so that all instructions 
following the ISB are fetched from cache or memory again, after the ISB instruction has been completed. 


Condition flags 


This instruction does not change the flags. 


SB 7 Instruction Synchronisation Barrier 
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3.11.7 MRS 
Move the contents of a special register to a general-purpose register. 


MRS{cond} Rd, spec_reg 























Where: 
cond 
Is an optional condition code. 
Rd 
Is the destination register. 
spec_reg 
Can be any of: APSR, IPSR, EPSR, IEPSR, IAPSR, EAPSR, PSR, MSP, PSP, PRIMASK, BASEPRI, BASEPRI_MAX, 
FAULTMASK, CONTROL,MSP_NS, PSP_NS, MSPLIM, PSPLIM, MSPLIM NS, PSPLIM NS, PRIMASK NS, 
FAULTMASK NS, and CONTROL NS. 
Note: All the EPSR and IPSR fields are zero when read by the MRS instruction. 
An access to a register not ending in_NS returns the register associated with the current Security state. Access 
to a register ending in_NS in Secure state returns the Non-secure register. Access to a register ending in _NS 
in Non-secure state is RAZ/WI. 
Operation 
Use MRS in combination with MSR as part of a read-modify-write sequence for updating a PSR, for example to 
clear the Q flag. 
In process swap code, the programmers model state of the process being swapped out must be saved, including 
relevant PSR contents. Similarly, the state of the process being swapped in must also be restored. These 
operations use MRS in the state-saving instruction sequence and MSR in the state-restoring instruction sequence. 
Note: BASEPRI MAX is an alias of BASEPRI when used with the MRS instruction. 
Restrictions 
Rd must not be SP and must not be PC. 
Condition flags 
This instruction does not change the flags. 
MRS RO, PRIMASK ; Read PRIMASK value and write it to RO 
3.11.8 MSR 
Move the contents of a general-purpose register into the specified special register. 
MSR{cond} spec_reg, Rn 
Where: 
cond 
Is an optional condition code. 
Rn 
Is the source register. 
spec_reg 
Can be any of: APSR_nzcvq, APSR_g, APSR_nzcvqg, MSP, PSP, PRIMASK, BASEPRI, BASEPRI_MAX, 
FAULTMASK, CONTROL, MSP_NS, PSP_NS -MSPLIM, PSPLIM, MSPLIM_NS, PSPLIM_NS, PRIMASK_NS, 
FAULTMASK _NS, and CONTROL _NS. 
Note: You can use APSR to refer to APSR_nzcvq. 
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Operation 


The register access operation in MSR depends on the privilege level. Unprivileged software can only access the 
APSR, see the APSR bit assignments. Privileged software can access all special registers. 


In unprivileged software writes to unallocated or execution state bits in the PSR are ignored. 


Note: When you write to BASEPRI_MAx, the instruction writes to BASE PRI only if either: 
° Rn is non-zero and the current BASEPRT value is 0. 
. Rn is non-zero and less than the current BASEPRI value. 


Note: An access to a register not ending in_NS writes the register associated with the current Security state. Access 
to a register ending in_NS in Secure state writes the Non-secure register. Access to a register ending in _NS in 
Non-secure state is RAZ/WI. 


Restrictions 


Rn must not be SP and must not be PC. 


Condition flags 


This instruction updates the flags explicitly based on the value in Rn. 


MSR CONTROL, Rl ; Read Rl value and write it to the CONTROL register. 


3.11.9 NOP 
No Operation. 
NOP{cond} 
Where: 

cond 


Is an optional condition code. 


Operation 


NOP does nothing. NoP is not necessarily a time-consuming NOP. The processor might remove it from the pipeline 
before it reaches the execution stage. 


Use NoP for padding, for example to place the following instruction on a 64-bit boundary. 
Condition flags 


This instruction does not change the flags. 


NOP ; No operation 


3.11.10 SEV 
Send Event. 


SEV{cond} 
Where: 
cond 


Is an optional condition code. 
Operation 


SEV is a hint instruction that causes an event to be signaled to all processors within a multiprocessor system. It 
also sets the local event register to 1. 


PM0264 - Rev 1 page 157/245 





PM0264 


Miscellaneous instructions 


<] 





Condition flags 


This instruction does not change the flags. 


SEV ; Send Event 


3.11.11 SG 
Secure Gateway. 
SG 


Operation 


Secure Gateway marks a valid branch target for branches from Non-secure code that wants to call Secure code. 


A linker is expected to generate a Secure Gateway operation as a part of the branch table for the Non-secure 
Callable (NSC) region. 


There is no C intrinsic function for SG. Secure Gateways are expected to be generated by linker or by assembly 
programming. Arm does not expect software developers to insert a Secure Gateway instruction inside C or C++ 
program code. 


Note: For information about how to build a Secure image that uses a previously generated import library, see the Arm® 
Compiler Software Development Guide. 


3.11.12 svc 


Supervisor Call. 


svc{conad} #imm 
Where: 
cond 
Is an optional condition code. 
imm 


Is an expression evaluating to an integer in the range 0-255 (8-bit value). 


Operation 


The Svc instruction causes the Svc exception. 


imm is ignored by the processor. If required, it can be retrieved by the exception handler to determine what 
service is being requested. 


Condition flags 


This instruction does not change the flags. 


SVC #0x32 7 Supervisor Call (SVCall handler can extract the immediate value 
7 by locating it through the stacked PC) 


3.11.13 TT, TTT, TTA, and TTAT 
Test Target (Alternate Domain, Unprivileged). 


{ op}{ cond} Rd, Rn 
Where: 
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op 
Is one of: 
TT 
Test Target (TT) queries the Security state and access permissions of a memory location. 
TTT 


Test Target Unprivileged (TTT) queries the Security state and access permissions of a memory location for an unprivileged 
access to that location. 


TTA 


Test Target Alternate Domain (TTA) queries the Security state and access permissions of a memory location for a Non-secure 
access to that location. These instructions are only valid when executing in Secure state, and are undefined if used from Non- 
secure state. 


TTAT 
Test Target Alternate Domain Unprivileged (TTAT) queries the Security state and access permissions of a memory location for a 


Non-secure and unprivileged access to that location. These instructions are only valid when executing in Secure state, and are 
undefined if used from Non-secure state. 


cond 

Is an optional condition code. 
Rd 

Is the destination general-purpose register into which the status result of the target test is written. 
Rn 


Is the base register. 


Operation 


The instruction returns the Security state and access permissions in the destination register, the contents of which 
are as follows: 


Table 43. Security state and access permissions in the destination register 


a 


[7:0] MREGION | The MPU region that the address maps to. This field is 0 if MRVALID is 0. 


. RAZ/WI The SAU region that the address maps to. This field is only valid if the instruction is executed 
from Secure state. This field is 0 if SRVALID is 0. 


[16] MRVALID _ Set to 1 if the MREGION content is valid. Set to 0 if the MREGION content is invalid. 


[15:8] | -SREGION 


(17] -SRVALID | . RAZ/WI Set to 1 if the SREGION content is valid. Set to 0 if the SREGION content is invalid. 


Read accessibility. Set to 1 if the memory location can be read according to the permissions of the 
[18] R selected MPU when operating in the current mode. For TTT and TTAT, this bit returns the permissions 
for unprivileged access, regardless of whether the current mode is privileged or unprivileged. 


Read/write accessibility. Set to 1 if the memory location can be read and written according to the 


Nel re permissions of the selected MPU when operating in the current mode. 
[31:20] | - RAZ/WI 
Equal to R AND NOT S. Can be used with the LSLS (immediate) instruction to check both the MPU and 
[20] NSR SAU or IDAU permissions. This bit is only valid if the instruction is executed from Secure state and the R 
field is valid. 


Equal to RW AND NOT S. Can be used with the LSLS (immediate) instruction to check both the MPU 
[21] NSRW and SAU or IDAU permissions. This bit is only valid if the instruction is executed from Secure state and 
the RW field is valid. 


Security. A value of 1 indicates that the memory location is Secure, and a value of 0 indicates that the 


a = memory location is Non-secure. This bit is only valid if the instruction is executed from Secure state. 
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IREGION valid flag. For a Secure request, indicates the validity of the IREGION field. Set to 1 if the 


IREGION content is valid. Set to 0 if the IREGION content is invalid. 
[23] IRVALID 
This bit is always 0 if the IDAU cannot provide a region number, the address is exempt from security 


attribution, or if the requesting TT instruction is executed from the Non-secure state. 


IDAU region number. Indicates the IDAU region number containing the target address. This field is 0 if 


[31:24] | IREGION IRVALID is 0. 


Invalid fields are 0. 

The MREGION field is invalid and 0 if any of the following conditions are true: 

° The MPU is not present or MPU_CTRL.ENABLE is 0. 

° The address did not match any enabled MPU regions. 

° The address matched multiple MPU regions. 

° TT was executed from an unprivileged mode, or TTA is executed and Non-secure state is unprivileged. 


The R, RW, NSR, and NSRW bits are invalid and 0 if any of the following conditions are true: 

° The address matched multiple MPU regions. 

° TT is executed from an unprivileged mode, or TTA is executed and Non-secure state is unprivileged. 
3.11.14 UDF 

Permanently Undefined. 

UDF{cond}.W {#}imm 


Where: 
imm 
Is a: 
. 8-bit unsigned immediate, in the range 0 to 255. The PE ignores the value of this constant. 
. 16-bit unsigned immediate, in the range 0 to 65535. The PE ignores the value of this constant. 
cond 


Arm deprecates using any c value other than AL. 


Operation 

Permanently Undefined generates an Undefined Instruction UsageFault exception. 
3.11.15 WFE 

Wait For Event. 


WFE{cona} 
Where: 
cond 


Is an optional condition code. 


Operation 


WFE is a hint instruction. 





If the event register is 0, WFE suspends execution until one of the following events occurs: 
. An exception, unless masked by the exception mask registers or the current priority level. 
. An exception enters the Pending state, if SEVONPEND in the System Control Register is set. 














. A Debug Entry request, if Debug is enabled. 
. An event signaled by a peripheral or another processor in a multiprocessor system using the SEV instruction. 





If the event register is 1, WFE clears it to 0 and returns immediately. 
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Condition flags 


This instruction does not change the flags. 


WFE ; Wait for event 


3.11.16 WFI 
Wait for Interrupt. 
WFl{cond} 
Where: 

cond 


Is an optional condition code. 


Operation 


WET is a hint instruction that suspends execution until one of the following events occurs: 
° A non-masked interrupt occurs and is taken. 

. An interrupt masked by PRIMASK becomes pending. 

. A Debug Entry request, if Debug is enabled. 


Condition flags 


This instruction does not change the flags. 


WFI ; Wait for interrupt 


3.11.17 YIELD 
Yield 


YIELD{cona} 
Where: 
cond 


Is an optional condition code. 


Operation 


YIELD is a hint instruction that enables software with a multithreading capability to indicate to the hardware that a 
task is being performed, which could be swapped out to improve overall system performance. Hardware can use 
this hint to suspend and resume multiple code threads if it supports the capability. 





Condition flags 


This instruction does not change the flags. 


YIELD; Suspend task 


3.12 Memory access instructions 


Table 44 shows the memory access instructions: 


Table 44. Memory access instructions 


ADR Generate PC-relative address Section 3.12.1 ADR 
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CLREX Clear Exclusive Section 3.12.12 CLREX 
LDM {mode } Load Multiple registers Section 3.12.6 LDM and STM 
LDA{ type} Load-Acquire Section 3.12.9 LDA and STL 
iDAEX Load-Acquire Exclusive Section 3.12.11 LDAEX and STLEX 
LDR{ type} Load Register using immediate offset Section 3.12.2 LDR and STR, immediate offset 
LDR{ type} Load Register using register offset Section 3.12.3 LDR and STR, register offset 
LDR{type}T Load Register with unprivileged access Section 3.12.4 LDR and STR, unprivileged 
LDR Load Register using PC-relative address Section 3.12.5 LDR, PC-relative 
LDRD Load Register Dual Section 3.12.2 LDR and STR, immediate offset 
iDREX{type } Load Register Exclusive Section 3.12.10 LDREX and STREX 
PLD Preload Data. Section 3.12.7 PLD 
POP Pop registers from stack Section 3.12.8 PUSH and POP 
PUSH Push registers onto stack Section 3.12.8 PUSH and POP 
STL{mode } Store-Release Section 3.12.9 LDA and STL 
STLEX Store Release Exclusive Section 3.12.11 LDAEX and STLEX 
STM{mode } Store Multiple registers Section 3.12.6 LDM and STM 
STR{type} Store Register using immediate offset Section 3.12.2 LDR and STR, immediate offset 
STR{type} Store Register using register offset Section 3.12.3 LDR and STR, register offset 
STR{type}T Store Register with unprivileged access Section 3.12.4 LDR and STR, unprivileged 
STREX{type} Store Register Exclusive Section 3.12.10 LDREX and STREX 
3.12.1 ADR 


Generate PC-relative address. 


ADR{cond} Rd, label 


Where: 
cond 
Is an optional condition code. 
Rd 
Is the destination register. 
label 
Is a PC-relative expression. 
Operation 
ADR generates an address by adding an immediate value to the PC, and writes the result to the destination 
register. 
ADR provides the means by which position-independent code can be generated, because the address is 
PC-relative. 
If you use ADR to generate a target address for a BX or BLX instruction, you must ensure that bit[0] of the address 
you generate is set to1 for correct execution. 
Values of /abe/ must be within the range of -4095 to +4095 from the address in the PC. 
Note: You might have to use the .W suffix to get the maximum offset range or to generate addresses that are not 


word-aligned. 
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3.12.2 


op 


LDR 


STR 


type 


SB 


SH 


cond 


Rt 


Rn 


offset 
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Restrictions 


Rd must not be SP and must not be PC. 


Condition flags 


This instruction does not change the flags. 


ADR Rl, TextMessage ; Write address value of a location labeliled as 
; TextMessage to Rl. 


LDR and STR, immediate offset 
Load and Store with immediate offset, pre-indexed immediate offset, or post-indexed immediate offset. 


op{type}{cond} Rt, [Rn {, #offset}] ; immediate offset 
op{type}{cond} Rt, [Rn, #offset]! ; pre-indexed 

op{type}{cond} Rt, [Rn], #offset ; post-indexed 

opD{cond} Rt, Rt2, [Rn{, #offset}] ; immediate offset, two words 
opD{cond} Rt, Rt2, [Rn, offset]! ; pre-indexed, two words 
opD{cond} Rt, Rt2, [Rn], #0ffset ; post-indexed, two words 
Where: 


Is one of: 


Load Register. 


Store Register. 


Is one of: 


Unsigned byte, zero extend to 32 bits on loads. 


Signed byte, sign extend to 32 bits (LDR only). 


Unsigned halfword, zero extend to 32 bits on loads. 


Signed halfword, sign extend to 32 bits (LDR only). 


Omit, for word. 


Is an optional condition code. 


Is the register to load or store. 


Is the register on which the memory address is based. 


Is an offset from Rn. If offset is omitted, the address is the contents of Rn. 
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Rt2 


Is the additional register to load or store for two-word operations. 


Operation 


LDR instructions load one or two registers with a value from memory. 
STR instructions store one or two register values to memory. 
Load and store instructions with immediate offset can use the following addressing modes: 


Offset addressing The offset value is added to or subtracted from the address obtained from the register Rn. The 
result is used as the address for the memory access. The register Rn is unaltered. The 
assembly language syntax for this mode is: 


[Rn, #offset] 


Pre-indexed addressing The offset value is added to or subtracted from the address obtained from the register Rn. The 
result is used as the address for the memory access and written back into the register Rn. The 
assembly language syntax for this mode is: 


[Rn, #offset]! 


Post-indexed addressing The address obtained from the register Rn is used as the address for the memory access. The 
offset value is added to or subtracted from the address, and written back into the register Rn. 
The assembly language syntax for this mode is: 


[Rn], #offset 


The value to load or store can be a byte, halfword, word, or two words. Bytes and halfwords can either be signed 
or unsigned. 


The following table shows the ranges of offset for immediate, pre-indexed and post-indexed forms. 


Table 45. Offset ranges 


Instruction type Immediate offset Post-indexed 


Word, halfword, signed 


halfword, byte, or signed byte -255 to 4095 -255 to 255 -255 to 255 
ria weeds multiple of 4 in the range -1020 | multiple of 4 in the range multiple of 4 in the range 
to 1020 -1020 to 1020 -1020 to 1020 


Restrictions 


For load instructions: 

° Rt can be SP or PC for word loads only. 

. Rt must be different from Rt2 for two-word loads. 

° Rn must be different from Rt and Rt2 in the pre-indexed or post-indexed forms. 


When Rt is PC in a word load instruction: 

° Bit[0] of the loaded value must be 1 for correct execution. 

° A branch occurs to the address created by changing bit[0] of the loaded value to 0. 
° If the instruction is conditional, it must be the last instruction in the IT block. 


For store instructions: 
. Rt can be SP for word stores only. 
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° Rt must not be PC. 
° Rn must not be PC. 
° Rn must be different from Rt and Rt2 in the pre-indexed or post-indexed forms. 


Condition flags 


These instructions do not change the flags. 


LDR Ri, PRLO ; Loads R8 from the address in R10. 
LDRNE R2, [R5, #960]! 7 heads! (eondtertonally) R22 from a word 

7 960 bytes above the address in R5, and 
7 increments R5 by 960. 








STR R2, [R9,#const-struc] ; const-struc is an expression evaluating 
7 to a constant in the range 0-4095. 

STRH Re ERA 7 Store R3 as halfword data into address in 
; R4, then increment R4 by 4. 

LDRD R8, R9, [R3, #0x20] 7 Load R8 from a word 32 bytes above the 


address in R3, and load R9 from a word 36 
bytes above the address in R3. 


~ 


~~ 











STRD RO, Rl, [R8], #-16 ; Store RO to address in R8, and store Rl to 
7 a word 4 bytes above the address in R8, 
7 and then decrement R8 by 16. 
3.12.3 LDR and STR, register offset 


Load and Store with register offset. 


op{type}{cond} Rt, [Rn, Rm{, LSL #n}] 


Where: 
op 
Is one of: 
LDR 
Load Register. 
STR 
Store Register. 
type 
Is one of: 
B 
Unsigned byte, zero extend to 32 bits on loads. 
SB 
Signed byte, sign extend to 32 bits (LDR only). 
H 
Unsigned halfword, zero extend to 32 bits on loads. 
SH 
Signed halfword, sign extend to 32 bits (LDR only). 
omit, for word. 
cond 
Is an optional condition code. 
Rt 
Is the register to load or store. 
Rn 


Is the register on which the memory address is based. 
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Is a register containing a value to be used as the offset. 
LSL#n 


Is an optional shift, with n in the range 0-3. 


Operation 


LDR instructions load a register with a value from memory. 
STR instructions store a register value into memory. 


The memory address to load from or store to is at an offset from the register Rn. The offset is specified by the 
register Rm and can be shifted left by up to 3 bits using LSL. 


The value to load or store can be a byte, halfword, or word. For load instructions, bytes and halfwords can either 
be signed or unsigned. 


Restrictions 


In these instructions: 

° Rn must not be PC. 

° Rm must not be SP and must not be PC. 

° Rt can be SP only for word loads and word stores. 
. Rt can be PC only for word loads. 


When Rt is PC in a word load instruction: 


. Bit[0] of the loaded value must be 1 for correct execution, and a branch occurs to this halfword-aligned 
address. 


° If the instruction is conditional, it must be the last instruction in the IT block. 


Condition flags 


These instructions do not change the flags. 


Syibiee RO, RS, Bil] Store value of RO into an address equal to 
Sum of RS and Ri. 

Read byte value from an address equal to 

sum of R5 and two times Rl, sign extended it 
to a word value and put at an’ RO: 

Stores RO to an address equal to sum of R1 
and four times Rz. 


LDRSB RO, [R5, Rl, LSL #1] 


STR IO), |e, 12, Si) 4222] 


Sh Sh Sh Sh sh sa 8 


3.12.4 LDR and STR, unprivileged 
Load and Store with unprivileged access. 
op{type}T{cond} Rt, [Rn {, #offset}] 
Where: 
op 
Is one of: 
LDR 
Load Register. 
STR 


Store Register. 
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type 
Is one of: 


Unsigned byte, zero extend to 32 bits on loads. 
SB 


Signed byte, sign extend to 32 bits (LDR only). 


Unsigned halfword, zero extend to 32 bits on loads. 
SH 


Signed halfword, sign extend to 32 bits (LDR only). 


Omit, for word. 

cond 

Is an optional condition code. 
Rt 

Is the register to load or store. 
Rn 

Is the register on which the memory address is based. 
offset 


Is an immediate offset from Rn and can be 0 to 255. If offset is omitted, the address is the value in Rn. 


Operation 


These load and store instructions perform the same function as the memory access instructions with immediate 
offset. The difference is that these instructions have only unprivileged access even when used in privileged 
software. 


When used in unprivileged software, these instructions behave in exactly the same way as normal memory 
access instructions with immediate offset. 


Restrictions 


In these instructions: 
. Rn must not be PC. 
° Rt must not be SP and must not be PC. 


Condition flags 


These instructions do not change the flags. 


STRBTEO R4, [R7] Conditionally store least significant byte in 
R4 to an address in R7, with unprivileged access. 
Load halfword value from an address equal to 


sum of R2 and 8 into R2, with unprivileged access. 


LDRHT R2, [R2, #8] 


Ne Ne se Ne 


3.12.5 LDR, PC-relative 
Load register from memory. 


LDR{type}{cond} Rt, label 
LDRD{cond} Rt, Rt2, label ; Load two words 
Where: 
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type 
Is one of: 
B 
Unsigned byte, zero extend to 32 bits. 
SB 
Signed byte, sign extend to 32 bits. 
H 
Unsigned halfword, zero extend to 32 bits. 
SH 
Signed halfword, sign extend to 32 bits. 
Omit, for word. 
cond 
Is an optional condition code. 
Rt 
Is the register to load or store. 
Rt2 
Is the second register to load or store. 
label 
Is a PC-relative expression. 
Operation 
LDR loads a register with a value from a PC-relative memory address. The memory address is specified by a label 
or by an offset from the PC. 
The value to load or store can be a byte, halfword, or word. For load instructions, bytes and halfwords can either 
be signed or unsigned. 
label must be within a limited range of the current instruction. The following table shows the possible offsets 
between label and the PC. 
Table 46. Offset ranges 
Word, halfword, signed halfword, byte, signed byte -4095 to 4095 
Two words -1020 to 1020 
Note: You might have to use the .W suffix to get the maximum offset range. 


Restrictions 


In these instructions: 

. Rt can be SP or PC only for word loads. 
° Rt2 must not be SP and must not be PC. 
. Rt must be different from Rt2. 


When Rt is PC in a word load instruction: 
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. Bit[0] of the loaded value must be 1 for correct execution, and a branch occurs to this halfword-aligned 
address. 


° If the instruction is conditional, it must be the last instruction in the IT block. 


Condition flags 


These instructions do not change the flags. 


Load RO with a word of data from an address 
labelled as LookUpTable. 

Load a byte value from an address labelled 
as localdata, sign extend it to a word 
value, and put Zt in Ri. 


LDR RO, LookUpTable 


LDRSB R7, localdata 


Se se se se 


3.12.6 LDM and STM 
Load and Store Multiple registers. 


op{addr_mode}{cond} Rn{!}, reglist 


Where: 
op 
Is one of: 
LDM 
Load Multiple registers. 
STM 
Store Multiple registers. 
addr_mode 
Is any one of the following: 
IA 
Increment address After each access. This is the default. 
DB 
Decrement address Before each access. 
cond 
Is an optional condition code. 
Rn 
Is the register on which the memory addresses are based. 
! 
Is an optional write-back suffix. If ! is present the final address, that is loaded from or stored to, is written back 
into Rn. 
reglist 


Is a list of one or more registers to be loaded or stored, enclosed in braces. It can contain register ranges. It 
must be comma separated if it contains more than one register or register range. 


LDMIA and LDMFD are synonyms for LDM. LDMFD refers to its use for popping data from Full Descending stacks. 





LDMEA is a synonym for LDMDB, and refers to its use for popping data from Empty Ascending stacks. 
STMIA and STMEA are synonyms for STM. STMEA refers to its use for pushing data onto Empty Ascending stacks. 





STMED is a synonym for STMDB, and refers to its use for pushing data onto Full Descending stacks. 


Operation 


LDM instructions load the registers in reglist with word values from memory addresses based on Rn. 
STM instructions store the word values in the registers in reglist to memory addresses based on Rn. 
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For LDM, LDMIA, LDMFD, STM, STMIA, and STMEA the memory addresses used for the accesses are at 4-byte 
intervals ranging from Rn to Rn + 4 * (n-1), where n is the number of registers in reglist. The accesses happens in 
order of increasing register numbers, with the lowest numbered register using the lowest memory address and the 
highest number register using the highest memory address. If the write-back suffix is specified, the value of Rn + 
4* (n-1) is written back to Rn. 


For LDMDB, LDMEA, STMDB, and STMFD the memory addresses used for the accesses are at 4-byte intervals 
ranging from Rn to Rn - 4 * (n-1), where n is the number of registers in reglist. The accesses happen in order of 
decreasing register numbers, with the highest numbered register using the highest memory address and the 
lowest number register using the lowest memory address. If the write-back suffix is specified, the value of Rn - 4 * 
(n-1) is written back to Rn. 


The PUSH and PoP instructions can be expressed in this form. 


Restrictions 


In these instructions: 

° Rn must not be PC. 

. reglist must not contain SP. 

. In any STM instruction, reglist must not contain PC. 

° In any LDM instruction, reglist must not contain PC if it contains LR. 
. reglist must not contain Rn if you specify the write-back suffix. 


When PC is in reglist in an LDM instruction: 


. Bit[0] of the value loaded to the PC must be 1 for correct execution, and a branch occurs to this halfword- 
aligned address 


° If the instruction is conditional, it must be the last instruction in the IT block. 


Condition flags 


These instructions do not change the flags. 


LDM FYE} UR); Bee IRS) ; LDMIA is a synonym for LDM. 
STMDB Heil Wp (UR SARG p ULAL RL |} 


Incorrect examples 


STM R5!,{R5,R4,R9} ; Value stored for R5 is unpredictable. 
LDM Ra, Ah ; There must be at least one register in the list. 
3.12.7 PLD 


Preload Data. 

PLD{cond} [Rn {, #imm}] ; Immediate 
PLD{cond} [Rn, Rm{, LSL #shift}] ; Register 
PLD{cond} label] ; Literal 


Where: 

cond 

Is an optional condition code. 
Rn 

Is the base register. 
imm 

Is the + or - immediate offset used to form the address. This offset can be omitted, meaning an offset of 0. 
Rm 


Is the optionally shifted offset register. 
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shift 
Specifies the shift to apply to the value read from <Rm>, in the range 0-3. If this option is omitted, a shift by 0 is 
assumed. 

label 


The label of the literal item that is likely to be accessed in the near future. 


Operation 


PLD signals the memory system that data memory accesses from a specified address are likely in the near future. 
If the address is cacheable then the memory system responds by pre-loading the cache line containing the 
specified address into the data cache. If the address is not cacheable, or the data cache is disabled, this 
instruction behaves as no operation. 


Restrictions 


There are no restrictions. 


Condition flags 
These instructions do not change the flags. 


3.12.8 PUSH and POP 
Push registers onto, and pop registers off a full-descending stack. 


PUSH{cond} reglist 
POP{conad} reglist 
Where: 

cond 


Is an optional condition code. 

reglist 
Is a non-empty list of registers, enclosed in braces. It can contain register ranges. It must be comma separated if 
it contains more than one register or register range. 


PUSH and POP are synonyms for STMDB and LDM (or LDMIA) with the memory addresses for the access based on 
SP, and with the final address for the access written back to the SP. PUSH and POP are the preferred mnemonics 
in these cases. 


Operation 


PUSH stores registers on the stack, with the lowest numbered register using the lowest memory address and the 
highest numbered register using the highest memory address. 


POP loads registers from the stack, with the lowest numbered register using the lowest memory address and the 
highest numbered register using the highest memory address. 


PUSH uses the value in the SP register minus four as the highest memory address, POP uses the value in the SP 
register as the lowest memory address, implementing a full-descending stack. On completion, PUSH updates the 
SP register to point to the location of the lowest store value, POP updates the SP register to point to the location 
above the highest location loaded. 


If a POP instruction includes PC in its reglist, a branch to this location is performed when the POP instruction has 
completed. Bit[0] of the value read for the PC is used to update the APSR T-bit. This bit must be 1 to ensure 
correct operation. 


Restrictions 


In these instructions: 

. reglist must not contain SP. 

° For the PUSH instruction, reglist must not contain PC. 

. For the PoP instruction, reglist must not contain PC if it contains LR. 
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When PC is in reglist ina POP instruction: 


° Bit[0] of the value loaded to the PC must be 1 for correct execution, and a branch occurs to this halfword- 
aligned address. 


° If the instruction is conditional, it must be the last instruction in the IT block. 


Condition flags 


These instructions do not change the flags. 


PUSH {RO,R4-R7} ; Push RO,R4,R5,R6,R/ onto the stack 


PUSH {R2,LR} 7 Push R2 and the link-register onto the stack 


POP {RO0,RG,PC} 7 Pop £0,r6 and PC from the stack, then branch to the mew PC. 


3.12.9 LDA and STL 
Load-Acquire and Store-Release. 


op{type}{cond} Rt, [Rn] 


Where: 
op 
Is one of: 
LDA 
Load-Acquire Register. 
STL 
Store-Release Register. 
type 
Is one of: 
B 
Unsigned byte, zero extend to 32 bits on loads. 
H 
Unsigned halfword, zero extend to 32 bits on loads.. 
cond 
Is an optional condition code. 
Rt 
Is the register to load or store. 
Rn 


Is the register on which the memory address is based. 


Operation 


LDA, LDAB, and LDAH loads word, byte, and halfword data respectively from a memory address. If any loads or 
stores appear after a load-acquire in program order, then all observers are guaranteed to observe the load- 
acquire before observing the loads and stores. Loads and stores appearing before a load-acquire are unaffected. 
STL, STLB, and STLH stores word, byte, and halfword data respectively to a memory address. If any loads or 
stores appear before a store-release in program order, then all observers are guaranteed to observe the loads 
and stores before observing the store-release. Loads and stores appearing after a store-release are unaffected. 


In addition, if a store-release is followed by a load-acquire, each observer is guaranteed to observe them in 
program order. 


There is no requirement that a load-acquire and store-release be paired. 
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All store-release operations are multi-copy atomic, meaning that in a multiprocessing system, if one observer 
observes a write to memory because of a store-release operation, then all observers observe it. Also, all 
observers observe all such writes to the same location in the same order. 


Restrictions 


The address specified must be naturally aligned, or an alignment fault is generated. 
The PC must not use SP for Rt. 


Condition flags 
These instructions do not change the flags. 


3.12.10 LDREX and STREX 
Load and Store Register Exclusive. 
LDREX{cond} Rt, [Rn {, #offset}] 
STREX{cond} Rad, Rt, [Rn {, #offset}] 
LDREXB{cond} Rt, [Rn] 
STREXB{cond} Ra, Rt, [Rn] 
LDREXH{condq} Rt, [Rn] 
STREXH{cond} Rd, Rt, [Rn] 
Where: 
cond 
Is an optional condition code. 
Rd 
Is the destination register for the returned status. 
Rt 
Is the register to load or store. 
Rn 
Is the register on which the memory address is based. 
offset 


Is an optional offset applied to the value in Rn. If offset is omitted, the address is the value in Rn. 


Operation 








LDREX, LDREXB, and LDREXH load a word, byte, and halfword respectively from a memory address. 


STREX, STREXB, and STREXH attempt to store a word, byte, and halfword respectively to a memory address. The 
address used in any Store-Exclusive instruction must be the same as the address in the most recently executed 
Load-exclusive instruction. The value stored by the Store-Exclusive instruction must also have the same data size 
as the value loaded by the preceding Load-exclusive instruction. This means software must always use a Load- 
exclusive instruction and a matching Store-Exclusive instruction to perform a synchronization operation. 

















If a Store-Exclusive instruction performs the store, it writes 0 to its destination register. If it does not perform the 
store, it writes 1 to its destination register. If the Store-Exclusive instruction writes 0 to the destination register, it is 
guaranteed that no other process in the system has accessed the memory location between the Load-exclusive 
and Store-Exclusive instructions. 


For reasons of performance, keep the number of instructions between corresponding Load-Exclusive and Store- 
Exclusive instruction to a minimum. 


Note: The result of executing a Store-Exclusive instruction to an address that is different from that used in the 
preceding Load-Exclusive instruction is unpredictable. 
Restrictions 


In these instructions: 
° Do not use PC. 
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° Do not use SP for Rd and Rt. 


. For STREX, Rd must be different from both Rt and Rn. 
. The value of offset must be a multiple of four in the range 0-1020. 


Condition flags 


These instructions do not change the flags. 


MOV R1, #0x1 
try 
LDREX RO, [LockAddr] 
CMP RO, #0 
ae EQ 





STREXEQ RO, R1, [LockAddr] 
CMPEQ RO, #0 
BNE ery, 





3.12.11 LDAEX and STLEX 


7 


Seren ee ee ee nT) 


Initialize the ‘lock taken’ value 


Load the lock value 

Is the lock free? 

IT instruction for STREXEQ and CMPEQ 
Try and claim the lock 

Did this succeed? 

NOES Se ry eacgeusn 

Yes - we have the lock. 


Load-Acquire and Store Release Exclusive. 


op{type} Rt, [Rn] 


Where: 
op 
Is one of: 
LDAEX 
Load Register. 
STLEX 
Store Register. 
type 
Is one of: 
B 
Unsigned byte, zero extend to 32 bits on loads. 
H 
Unsigned halfword, zero extend to 32 bits on loads.. 
cond 
is an optional condition code. 
Rd 
is the destination register for the returned status. 
Rt 
is the register to load or store. 
Rn 


is the register on which the memory address is based. 


Operation 


Load Register Exclusive calculates an address from a base register value and an immediate offset, loads a word 
from memory, writes it to a register and: 


° If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing core in a global monitor. 


° Causes the core that executes to indicate an active exclusive access in the local monitor. 
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Note: 


3.12.12 


cond 
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. If any loads or stores appear after LDAEX in program order, then all observers are guaranteed to observe the 
LDAEX before observing the loads and stores. Loads and stores appearing before LDAEX are unaffected. 








Store Register Exclusive calculates an address from a base register value and an immediate offset, and stores a 
word from a register to memory If the executing core has exclusive access to the memory addressed: 


. Rd is the destination general-purpose register into which the status result of the store exclusive is written, 
encoded in the Rd field. The value returned is: 


If the operation updates memory. 


If the operation fails to update memory. 


° If any loads or stores appear before STLEX in program order, then all observers are guaranteed to observe 
the loads and stores before observing the store-release. Loads and stores appearing after STLEX are 
unaffected. 








All store-release operations are multi-copy atomic. 


Restrictions 


In these instructions: 

° Do not use PC. 

° Do not use SP for Rdand Rt. 

° For STLEX, Rd must be different from both Rt and Rn. 





Condition flags 


These instructions do not change the flags. 


lock 
MOV R1, #0x1 7; Initialize the ‘lock taken’ value try 
LDAEX RO, [LockAddr] ; Load the lock value 
CMP RO, #0 ; Is the lock free? 
BNE try 7 No = “trey ageit 
STREX RO, Ri, [LockAddr] 7 Try and claim the lock 
CMP RO, #0 ; Did this succeed? 
BNE try 7? No = tery again 
; Yes — we have the lock. 
unlock 
MOV rl, #0 


Siri, iil, |, il0)] 


CLREX 
Clear Exclusive. 


CLREX{cond} 
Where: 


Is an optional condition code. 


Operation 




















Use CLREX to make the next STREX, STREXB, Or STREXH instruction write 1 to its destination register and fail to 
perform the store. CLREX enables compatibility with other Arm Cortex processors that have to force the failure of 
the store exclusive if the exception occurs between a load-exclusive instruction and the matching store-exclusive 
instruction in a synchronization operation. In Cortex-M processors, the local exclusive access monitor clears 
automatically on an exception boundary, so exception handlers using CLREX are optional. 
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Condition flags 


This instruction does not change the flags. 


CLREX 
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4 Cortex®-M33 peripherals 


4.1 About the Cortex®-M33 peripherals 


The address map of the Private peripheral bus (PPB) is: 


Table 47. Core peripheral register regions 


0xE000E000-0xEOOOEOOF Includes the Interrupt Controller Type and Auxiliary 
Control registers 


0xEOOOEDO0-0xEQOOED8F Section 4.3 System Control Block 


System control and ID registers 


OxEOOOEDF0-0xEQOOEEFF Debug registers in the SCS 
OxEOOOEF00-0xEQOOEF8F Includes the SW Trigger Interrupt Register 
OxEO00E010-OxEOOOEOFF System timer Section 4.4 System timer, SysTick 


Nested Vectored Interrupt Controller 


0xE000E100-0xEQOOECFF : 
registers 


Section 4.2 Nested Vectored Interrupt Controller 


Section 4.5.1 Security Attribution Unit 
OxEQOOEDO0-OxEOOOEDEF Security Attribution Unit 


OxEQOOED90-0xEQOOEDB8 Memory Protection Unit Section 4.5.9 Memory Protection Unit 
OxEQO0EF30-0xE000EF44 — Floating-Point Unit Section 4.6 Floating-Point Unit 


1. Software can read the MPU Type Register at OXEOOOED90 to test for the presence of a Memory Protection Unit (MPU). 


° The register type is described as follows: 


RW Read and write. 
RO Read-only. 

Wo Write-only. 
RAZ Read As Zero. 
WI Write Ignored. 


° The required privilege gives the privilege level that is required to access the register, as follows: 
Privileged Only privileged software can access the register. 


Unprivileged Both unprivileged and privileged software can access the register. 


° The peripheral registers are banked in Secure and Non-secure state. The Non-secure registers can be 
accessed in Secure state by using an aliased address at offset 00020000 from the normal register address. 
The alias locations are always RAZ/WI if accessed from Non-secure state. 


Note: Attempting to access a privileged register from unprivileged software results in a BusFault. 
4.2 Nested Vectored Interrupt Controller 


This section describes the Nested Vectored Interrupt Controller (NVIC) and the registers it uses. 
The NVIC supports: 
° 1-480 interrupts. 
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. A programmable priority level of 0-255. A higher level corresponds to a lower priority, so level 0 is the 
highest interrupt priority. In Non-secure state, the priority also depends on the value of AIRCR.PRIS.A 
programmable priority level of 0-255. A higher level corresponds to a lower priority, so level 0 is the highest 
interrupt priority. 

. Level and pulse detection of interrupt signals. 

. Interrupt tail-chaining. 

. An external Non-Maskable Interrupt (NMI). 

. Late arriving interrupts. 

The processor automatically stacks its state on exception entry and unstacks this state on exception exit, with no 

instruction overhead. This provides low latency exception handling. 


The following table shows the hardware implementation of NVIC registers. In an implementation with the Security 
Extension, register fields that are associated with interrupts designated as Secure in the ITNS register are always 
RAZ/WI if accessed from Non-secure state. 


Table 48. NVIC registers summary 


SS ee a 
rela wal (exe [=3 










































































NVIC_ISERO- Section 4.2.2 Interrupt Set 
E100-0xE NVIC_ISER15 Privileged 0x00000000 Enable Registers 
- ee - NVIC_ICERO- cad Section 4.2.3 Interrupt 
OXEO00E180- 0OxEOOOE1BC NVIC_ICER15 RW Privileged 0x00000000 Clear Enable Registers 
NVIC. ISPRO- Section 4.2.4 Interrupt Set 
OXEO00E200- 0xE000E23C = RW Privileged 0x00000000 | Pending Registers - Cortex- 
NVIC_ISPR15 M33 
6 - Medor 3 NVIC_ICPRO- bis Section 4.2.8 Interrupt 
OXEO00E280- 0OxEOOOE2BC NVIC_ICPR15 RW Privileged 0x00000000 Clear Pending Registers 
s - Act NVIC_IABRO- si Section 4.2.5 Interrupt 
OxE000E300-0xE000E33C NVIC_IABR15 RW Privileged 0x00000000 Active Bit Registers 
Section 4.2.6 Interrupt 
0xE000E380-0xE000E3BC pale la ace RW") | Privileged 0x00000000 Target Non-secure 
NVIC_ITNS15 : 
ie Registers. 
: AoE : NVIC_IPRO- as Section 4.2.7 Interrupt 
OxEQ00E400-0xE000E5DC NVIC_IPR119 RW Privileged 0x00000000 Priority Registers 
0xE000EF00 STIR WO |Configurable2) | 0x00000000 | Section 4.2.9 Software 


I 


ITNS is RAZ/WI from the Non-Secure state. 
2. See the register description for more information. 


Trigger Interrupt Register 








4.2.1 Accessing the NVIC registers using CMSIS 

CMSIS functions enable software portability between different Cortex-M profile processors. 

To access the NVIC registers when using CMSIS, use the following functions: 

Table 49. CMSIS access NVIC functions 

word a | (uint32 t Setpnanicgrenbing 

PriorityGroup) 

uint32 t NVIC_GetPriorityGrouping (void) Read the priority grouping 

void NVIC_EnableIRQ (IRQn Type IRQn) Enable a device-specific interrupt 

uint32_ t NVIC_GetEnableIRQ (IRQn Type IRQn) Get a device-specific interrupt enable status. 
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void NVIC_DisableIRQ (IRQn Type IRQn) Disable a device-specific interrupt 
uint32 t NVIC_GetPendingIRQ (IRQn Type IRQn) Get the pending device-specific interrupt 
void NVIC_SetPendingIRQ (IRQn Type IRQn) Set a device-specific interrupt to pending 
void NVIC_ClearPendingIRQ (IRQn Type IRQn) Clear a device-specific interrupt from pending 
uint32 t NVIC_GetActive (IRQn Type IRQn) Get the device-specific interrupt active 
void NVIC_SetPriority (IRQn_ Type IRQn, uint32 t 





Hee Set the priority for an interrupt 


uint32 t NVIC_GetPriority (IRQn Type IRQn) Get the priority of an interrupt 





uint32 t NVIC_EncodePriority (uint32 t 
PriorityGroup, uint32_ t PreemptPriority, uint32 t Encodes priority 
SubPriority) 


void NVIC_DecodePriority (uint32_t Priority, 
uint32 t PriorityGroup, uint32_t *pPreemptPriority, | Decode the interrupt priority 
uint32_ t *pSubPriority) 





uint32 t NVIC_GetVector (IRQn Type IRQn) Read interrupt vector 


id NVIC SetVect IR iy ERI INES? oe 
ee ide i ae eae > Modify interrupt vector 











vector) 
void NVIC_SystemReset (void) Reset the system 
uint32 t NVIC GetTargetState (IRQn Type IRQn) Get interrupt target state 
uint32 t NVIC_ SetTargetState (IRQn Type IROQn Set interrupt target state 
uint32 t NVIC_ClearTargetState (IRQn Type IRQn) Clear interrupt target state 
Note: The input parameter IRQn is the [RQ number. For more information on CMSIS NVIC functions, see http://arm- 


software.github.io/CMSIS_5/Core/html/group__NVIC__gr.html 


4.2.2 Interrupt Set Enable Registers 


The NVIC_ISERO-NVIC_ISER15 registers enable interrupts, and show which interrupts are enabled. 
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes. 


These registers are not banked between Security states. The register bits can be RAZ/WI depending on the value 
of NVIC_ITNS. 


The bit assignments are: 


31 0 


SETENA 


Table 50. NVIC_ISERn bit assignments 


fats Name rancton 


Interrupt set-enable bits. For SETENA[m] in NVIC_ISERn, allows interrupt 32n + m to be accessed. 





Write: 
[31:0] SETENA. 
0 No effect. 
1 Enable interrupt 32n+m. 
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Read: 
0 Interrupt 32n+m disabled. 
1 Interrupt 32n+m enabled. 


If a pending interrupt is enabled, the NVIC activates the interrupt based on its priority. If an interrupt is not 
enabled, asserting its interrupt signal changes the interrupt state to pending, but the NVIC never activates the 
interrupt, regardless of its priority. 


The register bits can be RAZ/WI depending on the value of NVIC_ITNS 


4.2.3 Interrupt Clear Enable Registers 


The NVIC_ICERO-NVIC_ICER15 registers disable interrupts, and show which interrupts are enabled. 
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes. 
The register bits can be RAZ/WI from Non-secure state depending on the value of NVIC_ITNS. 

These registers are not banked between Security states. 

The bit assignments are: 


31 0 


CLRENA 


Table 51. NVIC_ICERn bit assignments 


Pesaro 


Interrupt clear-enable bits. For SETENA[m] in NVIC_ICERn, allows interrupt 32n + m to be accessed. 


Write: 
0 No effect. 

[31:0] CLRENA | 1 Disable interrupt 32n+m. 
Read: 
0 Interrupt 32n+m disabled. 
1 Interrupt 32n+m enabled. 

4.2.4 Interrupt Set Pending Registers - Cortex-M33 
The NVIC_ISPRO-NVIC_ISPR15 registers force interrupts into the pending state, and shows which interrupts are 


pending. 

See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes. 
The register bits can be RAZ/WI from Non-secure state depending on the value of NVIC_ITNS. 

These registers are not banked between Security states. 

The bit assignments are: 


31 0 


SETPEND 
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Table 52. NVIC_ISPRn bit assignments 


Peis Fame rancton 


Interrupt set-pending bits. For SETPEND[m] in NVIC_ISPRn, allows interrupt 32n + m to be accessed. 


Write: 
0 No effect. 
[31:0] SETPEND | 1 Pend interrupt 32n + m. 
Read: 
0 Interrupt 32n + m is not pending. 
1 Interrupt 32n + m pending. 
Note: Writing 1 to the NVIC_ISPR bit corresponding to: 


° An interrupt that is pending has no effect. 
° A disabled interrupt sets the state of that interrupt to pending. 


4.2.5 Interrupt Active Bit Registers 


The NVIC_IABRO-NVIC_IABR15 registers indicate the active state of each interrupt. 

See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes. 
The register bits can be RAZ/WI depending on the value of NVIC_ITNS. 

These registers are not banked between Security states. 

The bit assignments are: 


31 0 


ACTIVE 


Table 53. NVIC_IABRn bit assignments 


Peis ame ton 


Active state bits. For ACTIVE[m] in NVIC_IABRn, indicates the active state for interrupt 32n+m. 


[31:0] ACTIVE | 0 The interrupt is not active. 
1 The interrupt is active. 
4.2.6 Interrupt Target Non-secure Registers 


The NVIC_ITNSO-NVIC_ITNS15 determine, for each group of 32 interrupts, whether each interrupt targets Non- 
secure or Secure state. Otherwise, This register is RAZ/WI 


See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes. 
This register is accessible from Secure state only. 
The bit assignments are: 


31 0 


ITNS 
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Table 54. NVIC_ITNSn bit assignments 


Peis ame rurcton 


Interrupt Targets Non-secure bits. For ITNS[m] in NVIC_ITNSn, this field indicates and allows modification of 
the target Security state for interrupt 32n+m. 


[esa) ike 0 The interrupt targets Secure state. 
1 The interrupt targets Non-secure state. 
4.2.7 Interrupt Priority Registers 


The NVIC_IPRO-NVIC_IPR119 registers provide an 8-bit priority field for each interrupt. These registers are word, 
halfword, and byte accessible. 


See the register summary in Section 4.2 Nested Vectored Interrupt Controller for their attributes. 
Each register holds four priority fields as shown: 

















31 24 23 16 15 8 7 0 
NVIC_IPR119 PRI_479 PRI_478 PRI_477 PRI_476 
NVIC_IPRn PRI_(4n+3) PRI_(4n+2) PRI_(4n+1) PRI_(4n) 
NVIC_IPRO PRI_3 PRI_2 PRI_1 PRI_O 








Table 55. NVIC_IPRn bit assignments 


Fis mame rurcton 


Priority, 
[31:24] | byte offset 
3 


Priority, 

[23:16] | byte Rel Each priority field holds a priority value. The priority depends on the value of PRIS for exceptions 
targeting the Non-secure state. If the processor implements fewer than 8 bits of priority, then the least 
significant bits of this field are resO. Each priority field holds a priority value. The lower the value, the 

Priority, greater the priority of the corresponding interrupt. If the processor implements fewer than 8 bits of 

[15:8] offset — priority, then the least significant bits of this field are res0. 


Priority, 
[7:0] byte offset 
0 


See Section 4.2.1 Accessing the NVIC registers using CMSIS for more information about the access to the 
interrupt priority array, which provides the software view of the interrupt priorities. 


Find the NVIC_IPR number and byte offset for interrupt M as follows: 
. The corresponding NVIC_IPR number, N, is given by N = N DIV 4. 
. The byte offset of the required Priority field in this register is M MOD 4, where: 
- Byte offset 0 refers to register bits[7:0]. 
- Byte offset 1 refers to register bits[15:8]. 
- Byte offset 2 refers to register bits[23: 16]. 
- Byte offset 3 refers to register bits[31:24]. 
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Priority values depend on the value of PRIS. 
The register bits can be RAZ/WI depending on the value of NVIC_ITNS. 
These registers are not banked between Security states. 


4.2.8 Interrupt Clear Pending Registers 


The NVIC_ICPRO-NVIC_ICPR15 registers remove the pending state from interrupts, and shows which interrupts 
are pending. 

See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes. 

The register bits can be RAZ/WI depending on the value of NVIC_ITNS. 

These registers are not banked between Security states. 

The bit assignments are: 


31 0 


CLRPEND 


Table 56. NVIC_ICPRn bit assignments 


Pats name nce 


Interrupt clear-pending bits. 





Write: 
0 No effect. 
[31:0] CLRPEND | 1 Clear pending state of interrupt 32n + m. 
Read: 
0 Interrupt 32n + m is not pending. 
1 Interrupt 32n + m is pending. 
Note: Writing 1 to an NVIC_ICPR bit does not affect the active state of the corresponding interrupt. 
4.2.9 Software Trigger Interrupt Register 


Write to the STIR to generate an interrupt from software. 
When the USERSETMPEND bit in the CCR is set to 1, unprivileged software can access the STIR. 


Note: Only privileged software can enable unprivileged access to the STIR. 
See Section 4.2 Nested Vectored Interrupt Controller for the register attributes. 
This register is not banked between Security states. 
The bit assignments are: 


31 9 8 0 


RESO INTID 
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Table 57. STIR bit assignments 


Peis rk rercton 


[31:9] | - Reserved, res0. 


Interrupt ID of the interrupt to trigger, in the range 0-479. For example, a value of 0x03 specifies interrupt 


[8:0] INTID a3, 


4.2.10 Level-sensitive and pulse interrupts 


The processor supports both level-sensitive and pulse interrupts. Pulse interrupts are also described as edge- 
triggered interrupts. 


A level-sensitive interrupt is held asserted until the peripheral deasserts the interrupt signal. Typically this 
happens because the ISR accesses the peripheral, causing it to clear the interrupt request. A pulse interrupt is an 
interrupt signal sampled synchronously on the rising edge of the processor clock. To ensure that the NVIC detects 
the interrupt, the peripheral must assert the interrupt signal for at least one clock cycle, during which the NVIC 
detects the pulse and latches the interrupt. 


When the processor enters the ISR, it automatically removes the pending state from the interrupt. 


For a level-sensitive interrupt, if the signal is not deasserted before the processor returns from the ISR, the 
interrupt becomes pending again, and the processor must execute its ISR again. This means that the peripheral 
can hold the interrupt signal asserted until it no longer requires servicing. 


See <reference required> for details of which interrupts are level-sensitive and which are pulsed. 


4.2.10.1 Hardware and software control of interrupts 
The processor latches all interrupts. A peripheral interrupt becomes pending for one of the following reasons: 
° The NVIC detects that the interrupt signal is active and the corresponding interrupt is not active. 
° The NVIC detects a rising edge on the interrupt signal. 
° Software writes to the corresponding Interrupt Set Enable Register bit. 


A pending interrupt remains pending until one of the following occurs: 


° The processor enters the ISR for the interrupt. This changes the state of the interrupt from pending to active. 
Then: 


- For a level-sensitive interrupt, when the processor returns from the ISR, the NVIC samples the interrupt 
signal. If the signal is asserted, the state of the interrupt changes to pending, which might cause the 
processor to immediately reenter the ISR. Otherwise, the state of the interrupt changes to inactive. 


- For a pulse interrupt, the NVIC continues to monitor the interrupt signal, and if this is pulsed the state of 
the interrupt changes to pending and active. In this case, when the processor returns from the ISR the 
state of the interrupt changes to pending, which might cause the processor to immediately reenter the 
ISR. 


If the interrupt signal is not pulsed while the processor is in the ISR, when the processor returns from 
the ISR the state of the interrupt changes to inactive. 


. Software writes to the corresponding Interrupt Clear Pending Register bit. 


For a level-sensitive interrupt, if the interrupt signal is still asserted, the state of the interrupt does not 
change. Otherwise, the state of the interrupt changes to inactive. 


For a pulse interrupt, state of the interrupt changes to: 
- Inactive, if the state was pending. 
-— Active, if the state was active and pending. 


4.2.11 NVIC usage hints and tips 
Ensure that software uses correctly aligned register accesses. The processor does not support unaligned 
accesses to NVIC registers. 
An interrupt can enter pending state even if it is disabled. Disabling an interrupt only prevents the processor from 
taking that interrupt. 


Before programming VTOR to relocate the vector table, ensure that the vector table entries of the new vector 
table are set up for fault handlers, NMI, and all enabled exceptions like interrupts. 
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4.2.11.1 NVIC programming hints 
Software uses the CPSIE i and CPSID i instructions to enable and disable interrupts. 





The CMSIS provides the following intrinsic functions for these instructions: 


void _ disable _irq(void) // Disable Interrupts 
void _ enable irq(void) // Enable Interrupts 


In addition, the CMSIS provides functions for NVIC control, listed in Section 4.2.1 Accessing the NVIC registers 
using CMSIS. 


The input parameter IRQn is the IRQ number, see Section 2.4.2 Exception types for more information. For more 
information about these functions, see the CMSIS documentation. 


4.3 System Control Block 


The System Control Block (SCB) provides system implementation information and system control that includes 
configuration, control, and reporting of system exceptions. 


The system control block registers are: 


Table 58. Summary of the system control block registers 


Required Reset 
Address Description 
redanal (xe [= value 


EOQOOE008 | ACTLR Privileged 00000000 Section 4.3.3 Auxiliary Control Register 
EOOOEDOO | CPUID RO Privileged | 0x410FD214 | Section 4.3.4 CPUID Base Register 
EOOOED04 | ICSR RW") Privileged 00000000 Section 4.3.5 Interrupt Control and State Register 


EOOOEDO8 | VITOR RW Privileged | UNKNOWN | Section 4.3.6 Vector Table Offset Register 

EOOOEDOC AIRCR RW\) Privileged | FA050000 Section 4.3.7 Application Interrupt and Reset Control Register 
EOOOED10 | SCR RW Privileged 00000000 Section 4.3.8 System Control Register 

EOQOOED14 | CCR RW Privileged | 0x00000201 | Section 4.3.9 Configuration and Control Register 

EOOO0ED18 | SHPR1 RW Privileged 00000000 Section 4.3.10.1 System Handler Priority Register 1 
EOO00ED1C SHPR2 RW Privileged | 00000000 | Section 4.3.10.2 System Handler Priority Register 2 
EOOOED20 | SHPR3 RW Privileged 00000000 Section 4.3.10.3 System Handler Priority Register 3 
EQO0ED24 |SHCSR RW Privileged 00000000 Section 4.3.11 System Handler Control and State Register 
EQOOED28 | CFSR RW Privileged 00000000 Section 4.3.12 Configurable Fault Status Register 


EO00ED28 | MMFSR?) | RW Privileged 00 Section 4.3.12.1 MemManage Fault Status Register 
EO00ED29_ BFSR?) RW Privileged 00 Section 4.3.12.2 BusFault Status Register 
EOO0ED2A | UFSR?) | RW Privileged | 0000 Section 4.3.12.3 UsageFault Status Register 


EOQOOED2C | HFSR RW Privileged 00000000 Section 4.3.13 HardFault Status Register 
EOOO0ED34 | MMFAR RW Privileged | UNKNOWN | Section 4.3.14 MemManage Fault Address Register 
EOOOED38 | BFAR RW Privileged | UNKNOWN | Section 4.3.15 BusFault Address Register 
EOOOED3C AFSR RAZ/WI | Privileged | - Auxiliary Fault Status Register not implemented 
EOOOED8C NSACR RW Privileged | UNKNOWN | Section 4.3.2 Non-secure Access Control Register 
1. See the register description for more information. 
2. A subregister of the CFSR. 

4.3.1 Coprocessor Access Control Register 


The CPACR register specifies the access privileges for the FPU. 
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See System control block registers summaryReference information for the SCB registers. for the CPACR 
attributes. 


In an implementation with the Security Extension, this field is banked between Security states. 


The CPACR bit assignments are: 


31 : 24. 19 : 0 





RESO : RESO 




















Table 59. CPACR bit assignments 


Ps [mame reno 


[31:24] | - Reserved, resO 
CP11 Privilege. The value in this field is ignored. 

[23:22] | CP11 
If the value of this bit is not programmed to the same value as the CP10 field, then the value is UNKNOWN. 
CP10 Privilege. Defines the access rights for the floating-point functionality. 


The possible values of this bit are: 


00 All accesses to the FP Extension result in NOCP UsageFault. 
[21:20] CP10 01 Unprivileged accesses to the FP Extension result in NOCP UsageFault. 
11 Full access to the FP Extension. 


All other values are reserved. 


The features controlled by this field are the execution of any floating-point instruction and access to any 
floating-point registers DO-D16. 


[19:0] | - Reserved, resO 


4.3.2 Non-secure Access Control Register 


The NSACR register defines the Non-secure access permissions for the FPU. 


See the System control block registers summaryReference information for the SCB registers. for the NSACR 
attributes. 


This field is not banked between Security states. 
The NSACR bit assignments are: 
131 ‘ 12'11109 817 ' 0! 





RESO RESO 























— CP10 
—CP11 





Table 60. NSACR bit assignments 


[31:12] - Reserved, res0. 


CP11 access. Enables Non-secure 
access to the Floating-point Extension. 


[11] cP11 Programming with a different value other 
than that used for CP10 is 
UNPREDICTABLE. 
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CP10 access. Enables Non-secure 
access to the Floating-point Extension. 


Non-secure accesses to the 
Floating-point Extension 


[10] CP10 : generate a NOCP 
UsageFault. 
Non-secure access to the 
1 Floating-point Extension 
permitted. 
[9:0] - Reserved, resO 


4.3.3 Auxiliary Control Register 


The ACTLR provides disable bits for the FPU exception outputs, dual-issue functionality, flushing of the trace 
output from the ITM and DWT, Exclusive instruction control, out-of-order floating point instructions, and handling 
interruptible instructions. 


By default, this register is set to provide optimum performance from the Cortex-M33 processor and does not 
normally require modification. 


See System control block registers summaryReference information for the SCB registers. for the ACTLR 
attributes. 


This register is banked between Security states. 
The ACTLR bit assignments are: 

































































31 30 29 28 : 131211109 8 :3.2 1 «0: 
UNK/SBZP UNK/SBZP 
— EXTEXCLALL 
— UNK/SBZP 
DISITMATBFLUSH — 
UNK/SBZP — 
FPEXCODIS— 
DISOOFP — 
DISFOLD — 
UNK/SBZP 
DISMCYCINT 


Table 61. ACTLR bit assignments 


Ps name rarcton 


[31:30] | - Reserved, UNK/SBZP 


Normal operation. Memory requests on Code region AHB (C-AHB) or 
System AHB (S-AHB) interfaces associated with LDREX and STREX 
instructions only assert HEXCL and respond to HEXOKAY if the 
address is shareable. 


[29] EXTEXCLALL All memory requests on C-AHB or S-AHB interfaces associated with 
LDREX and STREX instructions assert HEXCL and respond to 
HEXOKAY irrespective of the shareable attribute associated with the 
address. 


Setting EXTEXCLALL allows external exclusive operations to be used in a configuration with no 
MPU. This is because the default memory map does not include any shareable Normal memory. 


[28:13] | - Reserved. UNK/SBZP 
(12] DISITMATBFLUSH Disables ITM and DWT ATB flush: 
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Peis name rence 


0 Normal operation. 

ITM and DWT ATB flush disabled. AFVALID is ignored and AFREADY 
is held HIGH. 

[11] - Reserved. UNK/SBZP 


Disables FPU exception outputs: 


[10] FPEXCODIS 0 Normal operation. 
1 FPU exception outputs are disabled. 
Disables floating-point instructions completing out of order with respect to the non-floating point 
instructions: 
[9] Peer 0 Normal operation. 
1 Floating-point instructions completing out of order are disabled. 
[8:3] - Reserved. UNK/SBZP 
Disables dual-issue functionality: 
2] DISFOLD 0 Normal operation. 
4 Dual-issue functionality is disabled. Setting this bit reduces 
performance. 
[1] - Reserved. UNK/SBZP 
Disables interruption of multi-cycle instructions: 
0 Normal operation. 
[0] DISMCYCINT 
Disables interruption of multi-cycle instructions. This increases the 
1 interrupt latency of the processor because load, store, multiply, and 
divide operations complete before interrupt stacking occurs. 
4.3.4 CPUID Base Register 


The CPUID Base Register contains the processor part number, version, and implementation information. 


See System control block registers summaryReference information for the SCB registers. for the CPUID 
attributes. 


This register is not banked between Security states. 
The bit assignments are: 
31 24 23 20.19 16 15 43 0 





Implementer Variant Constant PartNo Revision 


Table 62. CPUID bit assignments 


Implementer code: 
[31:24] Implementer 
0x41 Arm 


[23:20] | Variant Variant number, the n value in the rnpm product revision identifier: 
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4.3.5 


PM0264 - Rev 1 


0 Revision 0 
[19:16] Constant Reads as OxF 

Part number of the processor: 
[15:4] | PartNo 

D21 Cortex-M33 

Revision number, the m value in the rnpm product revision identifier: 
[3:0] Revision 

4 Patch 2. 


Interrupt Control and State Register 

The ICSR provides a set-pending bit for the non-maskable interrupt exception, and set-pending and clear-pending 
bits for the PendSV and SysTick exceptions. 

The ICSR indicates: 

. The exception number of the exception being processed. 

° Whether there are pre-empted active exceptions. 

° The exception number of the highest priority pending exception 

° Whether any interrupts are pending. 


See System control block registers summaryReference information for the SCB registers. for the ICSR attributes. 
This register is banked between Security states on a bit by bit basis. 
The ICSR bit assignments are: 








31 30 29 28 27 26 25 24 23 22 21 20 1211109 8 0 
VECTPENDING VECTACTIVE 
PENDNMISET— LREsO LRESO 
PENDNMICLR ISRPENDING RETTOBASE 
RESO Reserved for Debug use 

PENDSVSET STTNS 

PENDSVCLR PENDSTCLR 

PENDSTSET 


Table 63. ICSR bit assignments with the Security Extension 


a | cs 


NMI set-pending bit. 


Write: 
0 No effect. 
1 Changes NMI exception state to 
pending. 
[31] PENDNMISET RW Read: 
0 NMI exception is not pending. 
1 NMI exception is pending. 


A read of this bit by the NMI exception handler returns 
1 only if the NMI signal is reasserted while the 
processor is executing that handler. 
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[30] 


[29] 


[28] 


[27] 


[26] 
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PENDNMICLR 


PENDSVSET 


PENDSVCLR 


PENDSTSET 


WoO 


RW 


WO 


RW 


If AARCR.BFHFNMINS is zero this bit is RAZ/WI from 
Non-secure state. 


This bit is not banked between Security states. 


Pend NMI clear bit. 


Write: 
0 No effect. 
1 Clear pending status. 


This bit is write-one-to-clear. Writes of zero are 
ignored. 


If AIRCR.BFHFNMINS is zero this bit is RAZ/WI from 
Non-secure state. 


This bit is not banked between Security states. 
Reserved, RESO 
PendSV set-pending bit. 


Write: 

0 No effect. 

1 Changes PendSV exception state to 
pending. 

Read: 

0 PendSV exception is not pending. 

1 PendSV exception is pending. 


Writing 1 to this bit is the only way to set the PendSV 
exception state to pending. 


This bit is banked between Security states. 


PendSV clear-pending bit. 


Write: 
0 No effect. 
1 Removes the pending state from the 


PendSV exception. 


This bit is banked between Security states. 


SysTick exception set-pending bit. 


Write: 

0 No effect. 

1 Changes SysTick exception state to 
pending. 

Read: 

0 SysTick exception is not pending. 
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[25] 


[24] 


[23] 


[22] 


[21] 


[20:12] 


[11] 


[10:9] 


[8:0] 
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PENDSTCLR 


STTNS 


Reserved for Debug use 


ISRPENDING 


VECTPENDING 


RETTOBASE 


VECTACTIVE") 


WO 


RO 


RO 


RO 


RO 


RO 


RO 


SysTick exception is pending. 


This bit is banked between Security states. 


SysTick exception clear-pending bit. 


Write: 
0 No effect. 

Removes the pending state from the 
4 : 3 

SysTick exception. 
This bit is WO. On a register read, its value is 
UNKNOWN. 
This bit is not banked between Security states. 
RESO 


This bit is reserved for Debug use and reads-as-zero 
when the processor is not in Debug. 


Interrupt pending flag, excluding NMI and Faults: 


0 Interrupt not pending. 


1 Interrupt not pending. 


This bit is not banked between Security states. 
Reserved, RESO 


Indicates the exception number of the highest priority 
pending enabled exception: 


0 No pending exceptions. 


The exception number of the highest 


Nonzero priority pending enabled exception. 


The value that this field indicates includes the effect of 
the BASEPRI and FAULTMASK registers, but not any 
effect of the PRIMASK register. 


This field is not banked between Security states. 


Indicates whether there are pre-empted active 
exceptions: 


There are pre-empted active 
exceptions to execute. 


There are no active exceptions, or the 
1 currently executing exception is the 
only active exception. 


This bit is not banked between Security states. 
Reserved, RESO 


Contains the active exception number: 


0 Thread mode. 
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The exception number'") of the 
currently active exception. 
Note: 


Subtract 16 from this value to obtain the CMSIS IRQ 
number required to index into the Interrupt Clear- 
Enable, Set-Enable, Clear-Pending, Set-Pending, or 
Priority Registers, see Section 2.1.3.6.2 Interrupt 
Program Status Register. 


This field is not banked between Security states. 


1. This is the same value as IPSR bits[8:0], see Section 2.1.3.6.2 Interrupt Program Status Register 


When you write to the ICSR, the effect is unpredictable if you: 
. Write 1 to the PENDSVSET bit and write 1 to the PENDSVCLR bit. 
° Write 1 to the PENDSTSET bit and write 1 to the PENDSTCLR bit. 


Vector Table Offset Register 


The VTOR indicates the offset of the vector table base address from memory address 00000000. 

See System control block registers summaryReference information for the SCB registers. for the VTOR attributes. 
This register is not banked between Security states. 

The VTOR bit assignments are: 





TBLOFF RESO 


<See the configurable information after the register description table for information about the 
configuration of the boundary between TBLOFF field and the [6:0] field that follows.> 


Table 64. VTOR bit assignments 


Vector table base offset field. It contains bits[29:7] of the offset of the table base from the bottom of the 
[31:7] TBLOFF memory map.<See the configurable information after this table for information about the configuration of this 
field and the [6:0] field that follows.>. 


[6:0] _ - Reserved, res0. 


When setting TBLOFF, you must align the offset to the number of exception entries in the vector table. <Configure 
the next statement to give the information required for your implementation, the statement reminds you of how to 
determine the alignment requirement.> The minimum alignment is 32 words, enough for up to 16 interrupts. For 
more interrupts, adjust the alignment by rounding up to the next power of two. For example, if you require 21 
interrupts, the alignment must be on a 64-word boundary because the required table size is 37 words, and the 
next power of two is 64. 


Table alignment requirements mean that bits[6:0] of the table offset are always zero. 


Application Interrupt and Reset Control Register 


The AIRCR provides sets or returns interrupt control and reset configuration. 


See System control block registers summaryReference information for the SCB registers. for the AIRCR 
attributes. 


To write to this register, you must write 0x5FA to the VECTKEY field, otherwise the processor ignores the write. 
This register is banked between Security states on a bit by bit basis. 
The AIRCR bit assignments are: 
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31 i i 16.15 14 13 12:11 10 8.7 4.3 2 1 0: 
Read: VECTKEYSTAT 

































































Write: VECTKEY RESO RESO 
ENDIANNESS — 
PRIS — 
BFHFNMINS — 
PRIGROUP — 
SYSRESETREQS —! 
SYSRESETREQ — 
VECTCLRACTIVE — 
RESO — 


Table 65. AIRCR bit assignments without the Security Extension 


Ss SSS SS eS SSS) 


Register key: 

[31 16] Read: VECTKEYSTAT RW Reads as OxFA05. 

Write: VECTKEY On writes, write Ox5FA to VECTKEY, 

otherwise the write is ignored. 
Data endianness bit: 

[15] ENDIANNESS RO 
0 Little-endian. 

[14] PRIS RAZ/WI - 

[13] BFHFNMINS RAO/WI - 

[12:11] - - Reserved, RESO 
Interrupt priority grouping field. This field 

. determines the split of group priority from 

ae) PAleRonr re subpriority, see Section 4.3.7.1 Binary 
point. 

[7:4] - - Reserved, RESO 

[3] SYSRESETREQS RAZ/WI - 

[2] SYSRESETREQ RAZ/WI - 
Reserved for Debug use. This bit reads 
as 0. When writing to the register you 

[1] vO TE Tne ue must write 0 to this bit, otherwise behavior 
is UNPREDICTABLE. 

[0] - - Reserved, RESO 


Table 66. AIRCR bit assignments with the Security Extension 


SSS SSS ESS eS Eee 


Register key: 


Reads as OxFA05. 
[31:16] Rene VERT EE olen RW On writes, write OxSFA to VECTKEY, 


Write: VECTKEY otherwise the write is ignored. 


This Field is not banked between Security 
states. 
Data endianness bit: 
[15] ENDIANNESS RO 
0 Little-endian. 
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[14] 


[13] 


[12:11] 


[10:8] 


[7:4] 


[3] 
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PRIS 


BFHFNMINS 


PRIGROUP 


SYSRESETREQS 


RW from Secure 

state and RAZ/WI 
from Non-secure 

state. 


RAZ/WI 


RW from Secure- 
state and RO from 
Non-secure state. 


RAO/WI 


RW 


RW from Secure 
State and RAZ/WI 
from Non-secure 
state. 


RAZ/WI 


This bit is not banked between Security 
states. 


Prioritize Secure exceptions. The value of 
this bit defines whether Secure exception 
priority boosting is enabled. 


Priority ranges of Secure and 
0 Non-secure exceptions are 
identical. 


Non-secure exceptions are 
de-prioritized. 


This bit is not banked between Security 
states. 


BusFault, HardFault, and NMI Non-secure 
enable. The value of this bit defines 
whether BusFault and NMI exceptions are 
Non-secure, and whether exceptions 
target the Non-secure HardFault 
exception. 


The possible values are: 


BusFault, HardFault, and NMI 
are Secure. 


BusFault and NMI are Non- 
1 secure and exceptions can 
target Non-secure HardFault. 


This bit resets to 0. 


This bit is not banked between Security 
states. 


Reserved, RESO 


Interrupt priority grouping field. This field 
determines the split of group priority from 
subpriority, see Section 4.3.7.1 Binary 
point. 


This bit is banked between Security 
states. 


Reserved, RESO 


System reset request, Secure state only. 
The value of this bit defines whether the 
SYSRESETREQ bit is functional for Non- 
secure use: 


SYSRESETREQ functionality 
0 is available to both Security 
states. 


SYSRESETREQ functionality 
1 is only available to Secure 
state. 


This bit resets to zero on a Warm reset. 


This bit is not banked between Security 
states. 
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eae aes ee ee ae ee eee 


System reset request. This bit allows 


RW if 
software or a debugger to request a 
Die neee BERS system reset: 
is 0. 
bade Do not request a system 
SYSRESETREQS 0 
[2] SYSRESETREQ iseetio 1 fam reset. 
Non-secure state 
this bit acts as 1 Request a system reset. 
RAZ/WI. 
RAZIWI This bit is not banked between Security 


states. 


Reserved for Debug use. This bit reads 
as 0. When writing to the register you 
must write 0 to this bit, otherwise behavior 


[1] VECTCLRACTIVE wo is UNPREDICTABLE. 
This bit is not banked between Security 
states. 

[0] - - Reserved, RESO 


4.3.7.1 Binary point 


The PRIGROUP field indicates the position of the binary point that splits the PRI_n fields in the Interrupt Priority 
Registers into separate group priority and subpriority fields. 

The following table shows how the PRIGROUP value controls this split. <If you implement fewer than 8 priority 
bits you might require more explanation here, and want to remove invalid rows from the table, and modify the 
entries in the number of columns.> 


Table 67. Priority grouping 





ea | Interrupt priority level value, PRI_n[7:0] Number of 
0b000 DXXXXXXX.Y [7:1] 128 

0b001 DXXXXXX.YY [7:2] [1:0] 64 4 
0b010 DXXXXx. yyy [7:3] [2:0] 32 8 
0b011 DXxxx.yyyy [7:4] [3:0] 16 16 
0b100 Dxxx. yyyyy [7:5] [4:0] 8 32 
0b101 bxx.yyyyyy [7:6] [5:0] 4 64 
0b110 bx.yyyyyyy [7] [6:0] 2 128 
0b111 b.yyyyyyyy None [7:0] 1 256 


1. PRI_n[7:0] field showing the binary point. x denotes a group priority field bit, and y denotes a subpriority field bit. 


Note: Determining pre-emption of an exception uses only the group priority field. 


4.3.8 System Control Register 


The SCR controls features of entry to and exit from low-power state. 
See Section 4.3 System Control Block for the SCR attributes. 

This register is banked between Security states on a bit by bit basis. 
The bit assignments are: 
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31 


3.210 





RESO 


























SEVONPEND a 
SLEEPDEEPS 


SLEEPDEEP ~ 
SLEEPONEXIT — 
RESO 








Table 68. AIRCR bit assignments with the Security Extension 


[31:5] 

4] SEVONPEND 
[3] SLEEPDEEPS 
[2] SLEEPDEEP 

[1] SLEEPONEXIT 
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Reserved, RESO 
Send Event on Pending bit: 


Only enabled interrupts or events 
0 can wakeup the processor, disabled 
interrupts are excluded. 


Enabled events and all interrupts, 
1 including disabled interrupts, can 
wakeup the processor. 


When an event or interrupt enters pending state, 
the event signal wakes up the processor from 

WEE. If the processor is not waiting for an event, 
the event is registered and affects the next WFE. 


The processor also wakes up on execution of an 
SEV instruction or an external event. 


This bit is banked between Security states. 


Controls whether the SLEEPDEEP bit is only 
accessible from the Secure state: 


The SLEEPDEEP bit accessible 
from both Security states. 


The SLEEPDEEP bit behaves as 
1 RAZ/WI when accessed from the 
Non-secure state. 


This bit in only accessible from the Secure state, 
and behaves as RAZ/WI when accessed from the 
Nonsecure state. 


This bit is not banked between Security states. 


Controls whether the processor uses sleep or deep 
sleep as its low-power mode: 


0 Sleep 


1 Deep sleep 


This bit is not banked between Security states. 


Indicates sleep-on-exit when returning from 
Handler mode to Thread mode: 


Do not sleep when returning to 
Thread mode. 


page 196/245 





<] 


PM0264 


System Control Block 





[0] 


Enter sleep, or deep sleep, on return 


: from an ISR. 


Setting this bit to 1 enables an interrupt driven 
application to avoid returning to an empty main 
application. 


This bit is banked between Security states. 


- Reserved, RESO 


4.3.9 Configuration and Control Register 


The CCR is a read-only register and indicates some aspects of the behavior of the processor. 
This register is banked between Security states on a bit by bit basis. 
The bit assignments for CCR are: 


31 


19 18 17 16.15 110987 543210: 





RESO 





RESO RESO 


















































BP— 
Ic 
bc 
STKOFHFNMIGN— 

RES1 — 

BFHFNMIGN —! 

DIV_o_TRP— 

UNALIGN_TRP — 

RESO ~ 

USERSETMPEND — 

RES1 — 
































Table 69. CCR bit assignments with the Security Extension 


[31:19] 
[18] 
[17] 
[16] 
[15:11] 


[10] 


[9] 


[8] 
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- Reserved, RESO 


BP RAZ/WI. 
IC RAZ/WI. 
DC RAZ/WI. 


- Reserved, RESO 


Controls the effect of a stack limit violation while 
executing at a requested priority less than 0. 


0 Stack limit faults not ignored. 
STKOFHFNMIGN 


Stack limit faults at requested 
priorities of less than 0 ignored. 


This bit is banked between Security states. 
- Reserved, RESO 


Determines the effect of precise bus faults on 
handlers running at a requested priority less than 0. 


BFHFNMIGN 0 Precise bus faults are not ignored. 


Precise bus faults at requested 
priorities of less than 0 are ignored. 
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[7:5] - 
[4] DIV_O_TRP 
[3] UNALIGN_TRP 
[2] . 
[1] USERSETMPEND 
[0] : 

4.3.10 System Handler Priority Registers 


This bit is not banked between Security states. 
Reserved, RESO 


Divide by zero trap. Controls the generation of a 
DIVBYZERO UsageFault when attempting to 
perform integer division by zero. 


DIVBYZERO UsageFault generation 
disabled. 


DIVBYZERO UsageFault generation 
enabled. 


This bit is banked between Security states. 


Controls the trapping of unaligned word or halfword 
accesses. 


0 Unaligned trapping disabled. 


1 Unaligned trapping enabled. 


This bit is banked between Security states. 
Reserved, RESO 


User set main pending. Determines whether 
unprivileged accesses are permitted to pend 
interrupts from the STIR. 


Unprivileged accesses to the STIR 
generate a fault. 


Unprivileged accesses to the STIR 
are permitted. 


This bit is banked between Security states. 


Reserved, RES1 


The SHPR1-SHPR3 registers set the priority level, 0 to 255 of the exception handlers that have configurable 
priority. SHPR1-SHPR3 are byte accessible. 


See System control block registers summaryReference information for the SCB registers. for the SHPR1-SHPR3 


attributes. 


These registers are banked between Security states on a bit field by bit field basis. 
The system fault handlers and the priority field and register for each handler are: 


Table 70. System fault handler priority fields 


MemManage PRI_4 
BusFault PRI_5 
UsageFault PRI_6 
SecureFault PRI_7 
SVCall PRI_11 
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Section 4.3.10.1 System Handler Priority Register 1 


Section 4.3.10.2 System Handler Priority Register 2 


page 198/245 





PM0264 


System Control Block 





4.3.10.1 


4.3.10.2 


4.3.10.3 
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PendSV PRI_14 
SysTick PRI_15 


Section 4.3.10.3 System Handler Priority Register 3 


Each PRI_n field is 8 bits wide, but the processor implements only bits[7:M] of each field, and bits[M-1:0] read as 
zero and ignore writes. 


System Handler Priority Register 1 


Bit assignments for the SHPR1 register. 
31 : 24:23 16 15 8 7 


oO 





PRI_7 PRI_6 PRI_S PRI_4 




















Table 71. SHPR1 register bit assignments 


Priority of system handler 7, 
[31:24] PRI 7 SecureFault 
Always RAZ/WI 


PRI_7 is RAZ/WI from Non- 
secure state. 


Priority of system handler 6, PRI_6 is banked between 


as) ral UsageFault Security states. 
ae PRI_5 is RAZ/WI from Non- 
[15:8] PRI_5 ter SYSRAMURANGGT Ds | oe ae siete if 
AIRCR.BFHFNMINS is 0. 
[7:0] PRI_4 Priority of system handler 4, PRI_4 is banked between 


MemManage Security states. 


System Handler Priority Register 2 


Bit assignments for the SHPR2 register. 
31 24 23 0 


PRI_11 Reserved 


Table 72. SHPR2 register bit assignments 


[31:24] PRI 11 Priority of system handler 11, | PRI_11 is banked between 





SVCall Security states. 
[23:0] - Reserved - 
System Handler Priority Register 3 
Bit assignments for the SHPR3 register. 
31 24 23 16 15 0 


iia aaa 
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Table 73. SHPR3 register bit assignments 


Priority of system handler 15, 


PRI_15 is banked between 


[31:24] PRLS SysTick exception Security states. 

: Priority of system handler 14, | PRI_14 is is banked between 
[23:16] PRI_14 PendSV Security states. 
[15:0] - Reserved = 


4.3.11 System Handler Control and State Register 


The SHCSR enables the system handlers. It indicates the pending status of the BusFault, MemManage fault, and 
SVC exceptions, and indicates the active status of the system handlers. 


See System control block registers summaryReference information for the SCB registers. for the SHCSR 
attributes. 


This register is banked between Security states on a bit by bit basis. 
The SHCSR bit oe are: 


22 21 20,19 18 17 16,15 14 13 12,1110 9 8,7 6 5 4,3 2 i 0 


ce RRA 





ee 
SECUREFAULTPENDED- 


SECUREFAULTENA- 
USGFAULTENA- 
BUSFAULTENA- 

MEMFAULTENA:- 
SVCALLPENDED: 
BUSFAULTPENDED- 
MEMFAULTPENDED- 
USGFAULTPENDED. 





‘NMIACT 

SVCALLACT 
MONITORACT 
PENDSVACT 
SYSTICKACT 


(eS FAULTACT 
oe 
HARDFAULTACT 
USGFAULTACT 
SECUREFAULTACT 








Table 74. CCR bit assignments with the Security Extension 


[31:22] - Reserved, RESO 
[21] BP RAZ/WI. 
[20] IC RAZ/WI. 
[19] DC RAZ/WI. 
[18] - Reserved, RESO 
Controls the effect of a stack limit violation while 
executing at a requested priority less than 0. 
0 Stack limit faults not ignored. 
[10] STKOFHFNMIGN 
4 Stack limit faults at requested 
priorities of less than 0 ignored. 
This bit is banked between Security states. 
[9] - Reserved, RESO 
Determines the effect of precise bus faults on 
handlers running at a requested priority less than 0. 
[8] BFHFNMIGN 0 Precise bus faults are not ignored. 
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Precise bus faults at requested 
priorities of less than 0 are ignored. 
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This bit is not banked between Security states. 
[7:5] - Reserved, RESO 


Divide by zero trap. Controls the generation of a 
DIVBYZERO UsageFault when attempting to 
perform integer division by zero. 


DIVBYZERO UsageFault generation 
[4] DIV_O0_TRP disabled. 


DIVBYZERO UsageFault generation 
enabled. 


This bit is banked between Security states. 


Controls the trapping of unaligned word or halfword 
accesses. 


[3] UNALIGN TRP 0 Unaligned trapping disabled. 


1 Unaligned trapping enabled. 


This bit is banked between Security states. 
[2] - Reserved, RESO 


User set main pending. Determines whether 
unprivileged accesses are permitted to pend 
interrupts from the STIR. 


Unprivileged accesses to the STIR 
{1] USERSETMPEND generate a fault. 


Unprivileged accesses to the STIR 
are permitted. 


This bit is banked between Security states. 


[0] - Reserved, RES1 


If you disable a system handler and the corresponding fault occurs, the processor treats the fault as a hard fault. 
You can write to this register to change the pending or active status of system exceptions. An OS kernel can write 
to the active bits to perform a context switch that changes the current exception type. 


Caution: ° Software that changes the value of an active bit in this register without correct adjustment to the stacked 
content can cause the processor to generate a fault exception. Ensure software that writes to this register 
retains and t restores the current active status. 


. After you have enabled the system handlers, if you have to change the value of a bit in this register you 
must use a read-modify-write procedure. Using a read-modify-write procedure ensures that you change 
only the required bit. 


4.3.12 Configurable Fault Status Register 


The CFSR indicates the cause of a MemManage fault, BusFault, or UsageFault. 

See System control block registers summaryReference information for the SCB registers. for the CFSR attributes. 
This register is banked between Security states on a bit by bit basis. 

The CFSR bit assignments are: 
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31 16.15 8 7 0 
2 Bus Fault Status Memory Management 
Usage Fault Status Register Register Fault Status Register 
\ | | J 
UFSR BFSR MMFSR 


The CFSR is byte accessible. You can access the CFSR or its subregisters as follows: 
. Access the complete CFSR with a word access to 0xE000ED28. 

° Access the MMFSR with a byte access to OxEQOOED28. 

. Access the MMFSR and BFSR with a halfword access to OxEOOOED28. 

° Access the BFSR with a byte access to 0xEQOOED29. 

. Access the UFSR with a halfword access to OxEQOOED2A. 






























































4.3.12.1 MemManage Fault Status Register 


The MMFSR is a subregister of the CFSR. The flags in the MMFSR indicate the cause of memory access faults. 
In an implementation with the Security Extension, this field is banked between Security states. 
The bit assignments are: 

76543210 


MMARVALID an ie IACCVIOL 
RESO DACCVIOL 
3 PEF RESO 
MSTKERR MUNSTKERR 





Table 75. MMFSR bit assignments 


is] name neta 


MemManage Fault Address Register (MMFAR) valid flag: 


0 Value in MMFAR is not a valid fault address. 


[7] | MMARVALID ; 
MMFAR holds a valid fault address. 


If a MemManage fault occurs and is escalated to a HardFault because of priority, the HardFault handler 
must set this bit to 0. This prevents problems on return to a stacked active MemManage fault handler 
whose MMFAR value has been overwritten. 


[6] - Reserved, res0. 

0 No MemManage fault occurred during floating-point lazy state preservation. 
[5] .MLSPERR 

1 A MemManage fault occurred during floating-point lazy state preservation. 


MemManage fault on stacking for exception entry: 


0 No stacking fault. 


[4] MSTKERR 
1 Stacking for an exception entry has caused one or more access violations. 


When this bit is 1, the SP is still adjusted but the values in the context area on the stack might be 
incorrect. The processor has not written a fault address to the MMFAR. 
MemManage fault on unstacking for a return from exception: 


[3] | MUNSTKERR | 0 No unstacking fault. 


1 Unstack for an exception return has caused one or more access violations. 
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This fault is chained to the handler. This means that when this bit is 1, the original return stack is still 
present. The processor has not adjusted the SP from the failing return, and has not performed a new 
save. The processor has not written a fault address to the MMFAR. 


[2] - Reserved, res0. 


Data access violation flag: 


0 No data access violation fault. 


[1] DACCVIOL : ; 
The processor attempted a load or store at a location that does not permit 


the operation. 


When this bit is 1, the PC value stacked for the exception return points to the faulting instruction. The 
processor has loaded the MMFAR with the address of the attempted access. 


Instruction access violation flag: 


0 No instruction access violation fault. 


The processor attempted an instruction fetch from a location that does not 
permit execution. 


[0] IACCVIOL 


= 


This fault occurs on any access to an XN region, even when the MPU is disabled. 


When this bit is 1, the PC value stacked for the exception return points to the faulting instruction. The 
processor has not written a fault address to the MMFAR. 


Note: The MMFSR bits are sticky. This means as one or more fault occurs, the associated bits are set to 1. A bit that is 
set to 7 is cleared to O only by writing 1 to that bit, or by a reset. 


4.3.12.2 BusFault Status Register 


The BFSR is a subregister of the CFSR. The flags in the BFSR indicate the cause of a bus access fault. 
This field is not banked between Security states. 
The bit assignments are: 

76543210 


RESO 
UNSTKERR 


BFARVALID — LIBUSERR 
RESO PRECISERR 


STKERR 





Table 76. BFSR bit assignments 


BusFault Address Register (BFAR) valid flag: 
0 Value in BFAR is not a valid fault address. 


[7] BFARVALID BFAR holds a valid fault address. 


The processor sets this bit to 1 after a BusFault where the address is known. Other faults can set this bit 
to 0, such as a MemManage fault occurring later. 


If a BusFault occurs and is escalated to a hard fault because of priority, the hard fault handler must set 
this bit to 0. This prevents problems if returning to a stacked active BusFault handler whose BFAR value 
has been overwritten. 
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[6] - Reserved, res0. 

0 No bus fault occurred during floating-point lazy state preservation. 
[5] LSPERR 

1 A bus fault occurred during floating-point lazy state preservation. 


BusFault on stacking for exception entry: 


0 No stacking fault. 


[4] | STKERR 
1 Stacking for an exception entry has caused one or more BusFaults. 


When the processor sets this bit to 1, the SP is still adjusted but the values in the context area on the 
stack might be incorrect. The processor does not write a fault address to the BFAR. 


BusFault on unstacking for a return from exception: 


0 No unstacking fault. 


[3] | UNSTKERR : 
Unstack for an exception return has caused one or more BusFaults. 


This fault is chained to the handler. This means that when the processor sets this bit to 1, the original 
return stack is still present. The processor does not adjust the SP from the failing return, does not 
performed a new save, and does not write a fault address to the BFAR. 


[2] - Reserved, res0. 


Precise data bus error: 


0 No precise data bus error. 


[1] PRECISERR 
A data bus error has occurred, and the PC value stacked for the exception 
return points to the instruction that caused the fault. 


When the processor sets this bit to 1, it writes the faulting address to the BFAR. 


Instruction bus error: 


0 No instruction bus error. 
DO) /IBUSER 1 Instruction bus error. 
The processor detects the instruction bus error on prefetching an instruction, but it sets the IBUSERR 
flag to 1 only if it attempts to issue the faulting instruction. 
When the processor sets this bit to 1, it does not write a fault address to the BFAR. 
Note: The BFSR bits are sticky. This means as one or more fault occurs, the associated bits are set to 1. A bit that is 


set to 7 is cleared to O only by writing 1 to that bit, or by a reset. 


4.3.12.3 UsageFault Status Register 
The UFSR is a subregister of the CFSR. The UFSR indicates the cause of a UsageFault. 
In an implementation with the Security Extension, this field is banked between Security states. 
The bit assignments are: 


PM0264 - Rev 1 page 204/245 





<] 


PM0264 


System Control Block 



























































15 ' 109 8:7 5 4:3 2 1 0: 
RESO RESO 
DIVBYZERO— 
UNALIGNED — 
STKOF — 
NOCP— 
INVPC — 
INVSTATE — 
UNDEFINSTR 


Table 77. UFSR bit assignments 


Fis same nce 


[15:10] - 
[9] DIVBYZERO 
[8] UNALIGNED 
[7:5] - 

[4] STKOF 

[3] NOcCP 

[2] INVPC 
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Reserved, res0. 


Divide by zero flag. Sticky flag indicating whether an integer division by zero error has occurred. The 
possible values of this bit are: 


o 


Error has not occurred. 


1 Error has occurred. 


This bit resets to zero. 


Unaligned access flag. Sticky flag indicating whether an unaligned access error has occurred. The 
possible values of this bit are: 


o 


Error has not occurred. 


1 Error has occurred. 


This bit resets to zero. 
Reserved, res0. 


Stack overflow flag. Sticky flag indicating whether a stack overflow error has occurred. The possible 
values of this bit are: 


0 Error has not occurred. 


1 Error has occurred. 


This bit resets to zero. 


No coprocessor flag. Sticky flag indicating whether a coprocessor disabled or not present error has 
occurred. The possible values of this bit are: 


0 Error has not occurred. 


1 Error has occurred. 


This bit resets to zero. 


Invalid PC flag. Sticky flag indicating whether an integrity check error has occurred. The possible 
values of this bit are: 


0 Error has not occurred. 


1 Error has occurred. 


This bit resets to zero. 
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Fis name ncn 


Invalid state flag. Sticky flag indicating whether an EPSR.T or EPSR.IT validity error has occurred. 
The possible values of this bit are: 


1] INVSTATE 0 Error has not occurred. 


1 Error has occurred. 


This bit resets to zero. 


Undefined instruction flag. Sticky flag indicating whether an undefined instruction error has occurred. 
The possible values of this bit are: 


[0] UNDEFINSTR 0 Error has not occurred. 


1 Error has occurred. 


This bit resets to zero. 


Note: All the bits are sticky. This means as one or more fault occurs, the associated bits are set to 1. A bit that is set to 
7 is cleared to 0 only by writing 1 to that bit, or by a reset. 
4.3.13 HardFault Status Register 


The HFSR gives information about events that activate the HardFault handler. The HFSR register is read, write to 
clear. This means that bits in the register read normally, but writing 1 to any bit clears that bit to 0. 


See Section 4.3 System Control Block for the HFSR attributes. 
This register is not banked between Security states. 
The HFSR bit assignments are: 


31 30 29 210 


L FORCED vectra. —! 
DEBUGEVT RESO 





Table 78. HFSR bit assignments 


[31] DEBUGEVT Reserved for Debug use. When writing to the register you must write 1 to this bit, otherwise behavior is 
unpredictable. lf AIRCR.BFHFNMINS is zero this field is RAZ/WI from Non-secure state. 


Indicates a forced HardFault, generated by escalation of a fault with configurable priority that cannot be 
handled, either because of priority or because it is disabled: 


0 No forced HardFault. 
[30] | FORCED 


1 Forced HardFault. 


When this bit is set to 1, the HardFault handler must read the other fault status registers to find the 
cause of the fault. If AIRCR.BFHFNMINS is zero this field is RAZ/WI from Non-secure state. 


[29:2] - Reserved, res0. 


[1] VECTTBL Indicates a HardFault on a vector table read during exception processing: 
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0 No HardFault on vector table read. 


1 HardFault on vector table read. 


This error is always handled by the HardFault handler. 


When this bit is set to 1, the PC value stacked for the exception return points to the instruction that was 
pre-empted by the exception. If AIRCR.BFHFNMINS is zero this field is RAZ/WI from Non-secure state. 


[0] - Reserved, res0. 


Note: The HFSR bits are sticky. This means as one or more fault occurs, the associated bits are set to 1. A bit that is 
set to 7 is cleared to 0 only by writing 1 to that bit, or by a reset. 


4.3.14 MemManage Fault Address Register 


The MMFAR contains the address of the location that generated a MemManage fault. 


See System control block registers summaryReference information for the SCB registers. for the MMFAR 
attributes. 


This register is banked between Security states. 
The MMFAR bit assignments are: 


Table 79. MMFAR bit assignments 


Pes Fam ton 


[31:0] ADDRESS When the MMARVALID bit of the MMFSR is set to 1, this field holds the address of the location that 
, generated the MemManage fault 


When an unaligned access faults, the address is the actual address that faulted. Because a single read or write 
instruction can be split into multiple aligned accesses, the fault address can be any address in the range of the 
requested access size. 


Flags in the MMFSR indicate the cause of the fault, and whether the value in the MMFAR is valid. 
4.3.15 BusFault Address Register 


The BFAR contains the address of the location that generated a BusFault. 

See System control block registers summaryReference information for the SCB registers. for the BFAR attributes. 
This field is not banked between Security states. 

The BFAR bit assignments are: 


Table 80. BFAR bit assignments 


A 


[31:0] ADDRESS When the BFARVALID bit of the BFSR is set to 1, this field holds the address of the location that 
, generated the BusFault 


When an unaligned access faults the address in the BFAR is the one requested by the instruction, even if it is not 
the address of the fault. 


Flags in the BFSR indicate the cause of the fault, and whether the value in the BFAR is valid. 


4.3.16 System control block design hints and tips 
Ensure software uses aligned accesses of the correct size to access the system control block registers: 
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. Except for the CFSR and SHPR1-SHPR3, it must use aligned word accesses. 
. For the CFSR and SHPR1-SHPR3 it can use byte or aligned halfword or word accesses. 


In a fault handler, to determine the true faulting address: 
1. | Read and save the MMFAR or BFAR value. 


2. Read the MMARVALID bit in the MMFSR, or the BFARVALID bit in the BFSR. The MMFAR or BFAR 
address is valid only if this bit is 1. 


Software must follow this sequence because another higher priority exception might change the MMFAR or BFAR 
value. For example, if a higher priority handler pre-empts the current fault handler, the other fault might change 
the MMFAR or BFAR value. 


In addition, the CMSIS provides a number of functions for system control, including: 


Table 81. CMSIS function for system control 


void NVIC_SystemReset (void) Reset the system 


4.4 System timer, SysTick 


The processor has a 24-bit system timer, SysTick. In a implementation with Security Extension, there are two 24- 
bit system timers, a Non-secure SysTick timer and a Secure SysTick timer. In an implementation without the 
Security Extension, only a single 24-bit system timer, SysTick is used. 

When enabled, each timer counts down from the reload value to zero, reloads (wraps to) the value in the 
SYST_RVR on the next clock cycle, then decrements on subsequent clock cycles. Writing a value of zero to the 
SYST_RVR disables the counter on the next wrap. When the counter transitions to zero, the COUNTFLAG status 
bit is set to 1. Reading SYST_CSR clears the COUNTFLAG bit to 0. Writing to the SYST_CVR clears the register 
and the COUNTFLAG status bit to 0. The write does not trigger the SysTick exception logic. Reading the register 
returns its value at the time it is accessed. 


Note: When the processor is halted for debugging, the counter does not decrement. 
The system timer registers are: 


Table 82. System timer registers summary 


a 


EQ00E010 SYST_CSR 00000000 Section 4.4.1 SysTick Control and Status Register. 
EO00E014 §SYST_RVR RW > UNKNOWN Section 4.4.2 SysTick Reload Value Register. 
EOO0E018 §SYST_CVR RW > UNKNOWN Section 4.4.3 SysTick Current Value Register. 
EOOO0EO1C SYST_CALIB RO asi Section 4.4.4 SysTick Calibration Value Register. 


(SysTick calibration value) 


4.4.1 SysTick Control and Status Register 


The SYST_CSR controls and provides status date for the SysTick timer. 
See Section 4.4 System timer, SysTick for the SYST_CSR attributes. 
This register is banked between Security states. 

The bit assignments for SYST_CSR are: 

31 17 16:15 ‘3.2 1 0: 


RESO RESO 
COUNTFLAG | CLKSOURCE a 
TICKINT 


ENABLE 
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Table 83. SYST_CSR bit assignments 


[31:17] | - Reserved, res0. 
[16] COUNTFLAG | Returns 1 if timer counted to 0 since the last read of this register. 
[15:3] | - Reserved, res0. 


Selects the SysTick timer clock source: 
[2] CLKSOURCE 0 External reference clock. 


1 Processor clock. 


Enables SysTick exception request: 
[1] TICKINT 0 Counting down to zero does not assert the SysTick exception request. 


1 Counting down to zero asserts the SysTick exception request. 


Enables the counter: 


[0] ENABLE 0 Counter disabled. 
1 Counter enabled. 
4.4.2 SysTick Reload Value Register 


The SYST_RVR specifies the SysTick timer counter reload value. 

See Section 4.4 System timer, SysTick for the SYST_RVR attributes. 
This register is banked between Security states. 

The bit assignments for SYST_RVR are: 

31 : 24:23 ; : ; : : 0: 


RESO RELOAD 


Table 84. SYST_RVR bit assignments 


[31:24] | - Reserved, res0. 





Value to load into the SYST_CVR when the counter is enabled and when it reaches 0, see Section 


ee) | REOAe 4.4.2.1. Calculating the RELOAD value. 


4.4.2.1 Calculating the RELOAD value 


The SYST_RVR specifies the SysTick timer counter reload value. 


The RELOAD value can be any value in the range 0x00000001-OxOOFFFFFF. You can program a value of 0, but 
this has no effect because the SysTick exception request and COUNTFLAG are activated when counting from 1 
to 0. 

To generate a multi-shot timer with a period of N processor clock cycles, use a RELOAD value of N-1. For 
example, if the SysTick interrupt is required every 100 clock pulses, set RELOAD to 99. 


4.4.3 SysTick Current Value Register 


The SYST_CVR contains the current value of the SysTick counter. 
See Section 4.4 System timer, SysTick for the SYST_CVR attributes. 
This register is banked between Security states. 
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The bit assignments for SYST_CVR: 
31 : 24.23 i 0: 


RESO CURRENT 


Table 85. SYST_CVR bit assignments 


Ps Fame cursos 


[31:24] | - Reserved, res0. 





Reads the current value of the SysTick counter. 


[23:0] | CURRENT 
A write of any value clears the field to 0, and also clears the SYST_CSR.COUNTFLAG bit to 0. 


4.4.4 SysTick Calibration Value Register 


The SYST_CALIB register indicates the SysTick calibration value and parameters for the selected Security state. 
See Section 4.4 System timer, SysTick for the SYST_CALIB attributes. 

This register is banked between Security states. 

The bit assignments for SYST_CALIB_S, SYST_CALIB_NS, and SYST_CALIB are: 


31 30 29 24:23 0 


RESO TENMS 
|_ SKEW 
NOREF 





Table 86. SYST_CALIB register bit assignments 


Fis ame | rencton 


[31] NOREF | Reads as one. Indicates that no separate reference clock is provided. 


Reads as one. Calibration value for the 10ms inexact timing is not known because TENMS is not known. 


[oe] She This can affect the suitability of SysTick as a software real-time clock. 


[29:24] | - Reserved, res0. 


[23:0] _ TENMS_ Reads as zero. Indicates that calibration value is not known. 


If calibration information is not known, calculate the calibration value required from the frequency of the core clock 
or external clock. 


4.4.5 SysTick usage hints and tips 
The interrupt controller clock updates the SysTick counter. If this clock signal is stopped for low-power mode, the 
SysTick counter stops. 
Ensure software uses word accesses to access the SysTick registers. 


If the SysTick counter reload and current value are undefined at reset, the correct initialization sequence for the 
SysTick counter is: 


1. Program reload value. 
2. Clear current value. 
3. Program Control and Status register. 
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4.5 Security Attribution and Memory Protection 


The processor has an Security Attribution Unit (SAU) and a Memory Protection Unit (MPU) that provide fine grain 
memory control, enabling applications to use multiple privilege levels, separating and protecting code, data, and 
stack on a task-by-task basis. Such requirements are becoming critical in many embedded applications such as 
automotive systems. 


4.5.1 Security Attribution Unit 


The SAU determines the security of an address. 


For instructions, the SAU returns the security attribute (Secure or Non-secure) and identifies whether the 
instruction address is in a Non-secure callable region. 


For data, the SAU returns the security attribute (Secure or Non-secure). 


When a memory access is performed, the security of the address is verified by the SAU. Any address that 
matches multiple SAU regions will be marked with the most secure attribute of the matching regions. 


The following table shows a summary of the SAU registers. 


Table 87. SAU registers summary 


Faceross [name [Typ] Resets] escriion 


See Section 4.5.2 Security Attribution Unit Control Register. This is 
OxEQOOEDDO SAU_CTRL RW _ 00000000 the reset value in Secure state. In Non-secure state, this register is 
RAZ/WI. 


See Section 4.5.3 Security Attribution Unit Type Register. This is 
OxEQOOEDD4 SAU_TYPE RO 00000000 the reset value in Secure state. In Non-secure state, this register is 
RAZ/WI. SAU_TYPE [7:0] reflects the number of SAU regions. 


See Section 4.5.4 Security Attribution Unit Region Number 


ERED EE ee Ne a Soe Register. In Non-secure state, this register is RAZ/WI. 


See Section 4.5.5 Security Attribution Unit Region Base Address 


EEE Geer eer ee | ane Register. In Non-secure state, this register is RAZ/WI. 


Bit[0] resets to 0. 
See Section 4.5.6 Security Attribution Unit Region Limit Address 


OxEOOOEDEO SAU_RLAR RW _ Other bits resetto | Register. This is the reset value in Secure state. In Non-secure 
an UNKNOWN state, this register is RAZ/WI. 


value. 
OxEQOOEDE4 SFSR RW 00000000 See Section 4.5.7 Secure Fault Status Register. In Non-secure 
state, this register is RAZ/WI. 
OxEQOOEDE8 SFAR RW UNKNOWN See Section 4.5.8 Secure Fault Address Register. In Non-secure 


state, this register is RAZ/WI. 


Note: . Only Privileged accesses to the SAU registers are permitted. Unprivileged accesses generate a fault. 
. The SAU registers are word accessible only. Halfword and byte accesses are UNPREDICTABLE. 
. The SAU registers are RAZ/WI when accessed from Non-secure state. 
° The SAU registers are not banked between Security states. 

4.5.2 Security Attribution Unit Control Register 


The SAU_CTRL allows enabling of the Security Attribution Unit. 
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states. 
The SAU_CTRL bit assignments are: 
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ALLNS _| 
ENABLE 


Table 88. SAU_CTRL bit assignments 


Pes ame ton 


[31:2] | - Reserved, res0. 


All Non-secure. When SAU_CTRL.ENABLE is 0 this bit controls if the memory is marked as Non-secure or 
Secure. 


The possible values of this bit are: 


0 Memory is marked as Secure and is not Non-secure callable. 
[1] ALLNS 
1 Memory is marked as Non-secure. 
This bit has no effect when SAU_ENABLE is 1. 
Setting SAU_CTRL.ALLNS to 1 allows the security attribution of all addresses to be set by the IDAU in the 
system. 
Enable. Enables the SAU. 
The possible values of this bit are: 
[0] ENABLE. 2 The SAU is disabled. 


1 The SAU is enabled. 


This bit is RAZ/WI when the Security Extension is implemented without an SAU region. 


Security Attribution Unit Type Register 


The SAU_TYPE indicates the number of regions implemented by the Security Attribution Unit. 
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states. 
The SAU_TYPE bit assignments are: 


SREGION 








Table 89. SAU_TYPE bit assignments 


[31:8] - Reserved, res0. 
[7:0] SREGION SAU regions. The number of implemented SAU regions. 


Security Attribution Unit Region Number Register 


The SAU_RNR selects the region currently accessed by SAU_RBAR and SAU_RLAR. 
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states. 
The SAU_RNR bit assignments are: 


page 212/245 





PM0264 


Security Attribution and Memory Protection 


‘] 





31 87 0 


RESO REGION 


Table 90. SAU_RNR bit assignments 


Peis Pam rercton 


[31:8] | - Reserved, res0. 
Region number. Indicates the SAU region accessed by SAU_RBAR and SAU_RLAR. 


If no SAU regions are implemented, this field is reserved. Writing a value corresponding to an 


Oy | REGION unimplemented region is CONSTRAINED UNPREDICTABLE. 
This field resets to an UNKNOWN value on a Warm reset. 
4.5.5 Security Attribution Unit Region Base Address Register 


The SAU_RBAR provides indirect read and write access to the base address of the currently selected SAU 
region. 

This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states. 
The SAU_RBAR bit assignments are: 


31 5.4 0 


BADDR Reserved 


Table 91. SAU_RBAR bit assignments 


Base address. Holds bits[31:5] of the base address for the selected SAU region. 





[31:5] | BADDR 
Bits[4:0] of the base address are defined as 0x00. 


[4:0] - Reserved, res0. 


4.5.6 Security Attribution Unit Region Limit Address Register 


The SAU_RLAR provides indirect read and write access to the limit address of the currently selected SAU region. 
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states. 
The SAU_RLAR bit assignments are: 





RESO _| 
NSC 
ENABLE 


Table 92. SAU_RLAR bit assignments 


Pes ame ton 


Limit address. Holds bits[31:5] of the limit address for the selected SAU region. 
[31:5] LADDR 
Bits[4:0] of the limit address are defined as Ox1F. 


[4:2] | - Reserved, res0. 
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Non-secure callable. Controls whether Non-secure state is permitted to execute an SG instruction from this 
region. 


The possible values of this bit are: 


[1] NSC 
0 Region is not Non-secure callable. 
1 Region is Non-secure callable. 
Enable. SAU region enable. 
The possible values of this bit are: 

[0] ENABLE 0 SAU region is enabled. 
1 SAU region is disabled. 
This bit reset to 0 on a Warm reset. 

4.5.7 Secure Fault Status Register 


The SFSR provides information about any security related faults. 

This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states. 

See System control block registers summaryReference information for the SCB registers.for the SFSR attributes. 
The SFSR bit assignments are: 


34 876543210. 





RESO 






































LSERR— 
SFARVALID — 
LSPERR— 
INVTRAN — 
AUVIOL — 

INVER— 

INVIS— 

INVEP — 























Table 93. SFSR bit assignments 


[31:8] | - Reserved, res0. 
Lazy state error flag. Sticky flag indicating that an error occurred during lazy state activation or 
deactivation. The possible values of this bit are: 


[7] LSERR 0 Error has not occurred. 


1 Error has occurred. 


Secure fault address valid. This bit is set when the SFAR register contains a valid value. As with similar 
fields, such as BFSR.BFARVALID and MMFSR.MMARVALID, this bit can be cleared by other 
exceptions, such as BusFault. The possible values of this bit are: 


[6] SFARVALID 
0 SFAR content not valid. 


1 SFAR content valid. 


Lazy state preservation error flag. Stick flag indicating that an SAU or IDAU violation occurred during the 


[5] ESPERR lazy preservation of floating-point state. The possible values of this bit are: 
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0 Error has not occurred. 


1 Error has occurred. 


Invalid transition flag. Sticky flag indicating that an exception was raised due to a branch that was not 
flagged as being domain crossing causing a transition from Secure to Non-secure memory. The possible 
values of this bit are: 


[4] INVTRAN 
0 Error has not occurred. 


1 Error has occurred. 


Attribution unit violation flag. Sticky flag indicating that an attempt was made to access parts of the 
address space that are marked as Secure with NS-Req for the transaction set to Non-secure. This bit is 
not set if the violation occurred during: 


. Lazy state preservation, see LSPERR. 
. Vector fetches. 


[3] eee The possible values of this bit are: 


0 Error has not occurred. 


1 Error has occurred. 


Invalid exception return flag. This can be caused by EXC_RETURN.DCRS being set to 0 when returning 
from an exception in the Non-secure state, or by EXC_RETURN.ES being set to 1 when returning from 
an exception in the Non-secure state. The possible values of this bit are: 


[2] INVER 
0 Error has not occurred. 


1 Error has occurred. 
Invalid integrity signature flag. This bit is set if the integrity signature in an exception stack frame is found 
to be invalid during the unstacking operation. The possible values of this bit are: 


[1] | INVIS 0 Error has not occurred. 
4 Error has occurred. 


Invalid entry point. This bit is set if a function call from the Non-secure state or exception targets a non- 
SG instruction in the Secure state. This bit is also set if the target address is an SG instruction, but there 
is no matching SAU/IDAU region with the NSC flag set. The possible values of this bit are: 


[0] INVEP 
0 Error has not occurred. 


1 Error has occurred. 


4.5.8 Secure Fault Address Register 


The SFSR shows the address of the memory location that caused a security violation. 

This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states. 
The SFAR bit assignments are: 

| 31 o 


ADDRESS 
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Table 94. SFAR bit assignments 


Pes Fam ton 


[31:0] ADDRESS When the SFARVALID bit of the SFSR is set to 1, this field holds the address of an access that caused an 
. SAU violation. 


4.5.9 Memory Protection Unit 
The MPU is divided into eight regions and defines the location, size, access permissions, and memory attributes 
of each region. 
The MPU supports: 
° Independent attribute settings for each region. 
° Export of memory attributes to the system. 


If the processor implements the Security Extension, it contains: 
° One optional Secure MPU. 
° One optional Non-secure MPU. 


When memory regions overlap, the processor generates a fault if a core access hits the overlapping regions. 


The MPU memory map is unified. This means instruction accesses and data accesses have the same region 
settings. 


If a program accesses a memory location that is prohibited by the MPU, the processor generates a MemManage 
exception. 


In an OS environment, the kernel can update the MPU region setting dynamically based on the process to be 
executed. Typically, an embedded OS uses the MPU for memory protection. 


Configuration of MPU regions is based on memory types, see Section 2.3.2 Memory regions, types, and 
attributes. 


The following table shows the possible MPU region attributes. These include Shareability and cache behavior 
attributes that are not relevant to most microcontroller implementations. 


See Section 4.5.20.1 MPU configuration for a microcontroller for guidelines for programming such an 
implementation. 


Table 95. Memory attributes summary 


Used to access memory mapped peripherals.All accesses to 
Device-nGnRnE | Shareable - Device-nGnRnE memory occur in program order. All regions are 
assumed to be shared. 


Used to access memory mapped peripherals.Weaker ordering 


Device-nGnRE | Shareable - than Device-nGnRnE. 


Used to access memory mapped peripherals.Weaker ordering 


Device-nGRE Shareable - than Device-nGnRE. 


Used to access memory mapped peripherals.Weaker ordering 


Device-GRE Shareable - than Device-nGRE. 


Non-cacheable Write- 
Normal Shareable Through Cacheable Normal memory that is shared between several processors. 
Write-Back Cacheable 


Non-cacheable Write- 
Normal Non-Shareable | Through Cacheable Normal memory that only a single processor uses. 
Write-Back Cacheable 


Use the MPU registers to define the MPU regions and their attributes. 
The following table shows a summary of the MPU registers. 
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Table 96. MPU registers summary 


The reset value is fixed and 
depends on the value of 


EOOOED90 | MPU_TYPE RO bits[15:8] and implementation See Section 4.5.10 MPU Type Register. 
options. 
EOQOOED94 | MPU_CTRL RW 00000000 See Section 4.5.11 MPU Control Register. 
EOOOED98 | MPU_RNR RW > UNKNOWN See Section 4.5.12 MPU Region Number Register. 
EOOOED9C MPU RBAR RW UNKNOWN See Section 4.5.13 MPU Region Base Address 
= Register. 
EOOOEDAO ~MPU_RLAR RW UNKNOWN See Section 4.5.15 MPU Region Limit Address 


Register. 


See Section 4.5.14 MPU Region Base Address 


EOOOEDA4 MPU_RBAR_A<n> RW | UNKNOWN F : = 
Register Alias, n=1-3 


See Section 4.5.16 MPU Region Limit Address 


EOOOEDA8 MPU_RLAR_A<n> RW | UNKNOWN ; ; = 
Register Alias, n=1-3. 


EO00EDCO ~MPU_MAIRO RW = UNKNOWN See Section 4.5.17 MPU Memory Attribute 
EOOOEDC4 MPU_MAIR1 RW | UNKNOWN Paar nen eer aie t 
4.5.10 MPU Type Register 


The MPU_TYPE register indicates whether the MPU is present, and if so, how many regions it supports. 
This register is banked between Security states. 

In an implementation with the Security Extension, this register is banked between Security states. 

The MPU_TYPE bit assignments are: 


| 31 | | | 16| 15 | 8| 7 | 1 0| 


RESO DREGION RESO | 


SEPARATE sil 


Table 97. MPU_TYPE bit assignments 


Peis Fn runt 


[31:16] | - Reserved, res0. 


Data regions. Number of regions supported by the MPU. 


[15:8] DREGION 00 Zero regions if your device does not include the MPU. 
08 Eight regions if your device includes the MPU. This value is implementation 
defined. 
[721] - Reserved, res0. 


Indicates support for unified or separate instructions and data address regions. 


[0] SEPARATE Armv8-M only supports unified MPU regions. 


0 Unified. 


4.5.11 MPU Control Register 


The MPU_CTRL register enables the MPU. 


When the MPU is enabled, it controls whether the default memory map is enabled as a background region for 
privileged accesses and whether the MPU is enabled for HardFaults, and NMls. 
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This register is banked between Security states. 
In an implementation with the Security Extension, this register is banked between Security states. 
The MPU_CTRL bit assignments are: 


31 3.2 1 0 


RESO 
PRIVDEFENA—! 
HFNMIENA 
ENABLE 


Table 98. MPU_CTRL bit assignments 


Pets nme runt 


[31:3] | - Reserved, res0. 





Enables privileged software access to the default memory map. 
When the MPU is enabled: 


Disables use of the default memory map. Any memory access to a location 


12] paipecene that is not covered by any enabled region causes a fault. 


Enables use of the default memory map as a background region for 
privileged software accesses. 


When enabled, the background region acts as if it has the lowest priority. Any region that is defined 
and enabled has priority over this default map. If the MPU is disabled, the processor ignores this bit. 


Enables the operation of MPU during HardFault and NMI handlers. 
When the MPU is enabled: 


0 MPU is disabled during HardFault and NMI handlers, regardless of the 
[1] | HFNMIENA value of the ENABLE bit. 


1 The MPU is enabled during HardFault and NMI handlers. 


When the MPU is disabled, if this bit is set to 1 the behavior is UNPREDICTABLE. 
Enables the MPU: 


[0] ENABLE 0 MPU is disabled. 


f MPU is enabled. 


XN and Device-nGnRnE rules always apply to the System Control Space regardless of the value of the ENABLE 
bit. 

When the ENABLE bit is set to 1, at least one region of the memory map must be enabled for the system to 
function unless the PRIVDEFENA bit is set to 1. If the PRIVDEFENA bit is set to 1 and no regions are enabled, 
then only privileged software can operate. 


When the ENABLE bit is set to 0, the system uses the default memory map. This has the same behavior as if the 
MPU is not implemented. 


The default memory map applies to accesses from both privileged and unprivileged software. 


When the MPU is enabled, accesses to the System Control Space and vector table are always permitted. Other 
areas are accessible based on regions and whether PRIVDEFENA is set to 1. 
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Unless HFNMIENA is set to 1, the MPU is not enabled when the processor is executing the handler for an 
exception with priority —1,-2, or —3. These priorities are only possible when handling a HardFault or NMI 
exception. Setting the HFNMIENA bit to 1 enables the MPU when operating with these priorities. 


4.5.12 MPU Region Number Register 


The MPU_RNR selects the region currently accessed by MPU_RBAR and MPU_RLAR. 

This register is banked between Security states. 

In an implementation with the Security Extension, this register is banked between Security states. 
The MPU_RNR bit assignments are: 


31 8:7 0 


RESO REGION 


Table 99. MPU_RNR bit assignments 


fas ame ton 


[31:8] | - Reserved, res0. 





Regions. Indicates the memory region accessed by MPU_RBAR and PMU_RLAR. 


[7:0] | REGION | {f no MPU region is implemented, this field is reserved. Writing a value corresponding to an unimplemented 
region is CONSTRAINED UNPREDICTABLE. 


You must write the required region number to this register before accessing the MPU_RBAR or MPU_RLAR. 


4.5.13 MPU Region Base Address Register 


The MPU_RBAR defines the base address of the MPU region selected by the MPU_RNR. 

This register is banked between Security states. 

In an implementation with the Security Extension, this register is banked between Security states. 
The MPU_RBAR bit assignments are: 


31 5432 10 


SH + | 
AP[2:1] 
XN 


Table 100. MPU_RBAR bit assignments 


Peis mame rancor 


Contains bits[31:5] of the lower inclusive limit of the selected MPU memory region. This value is zero 


BASE 





[Piel | Broe extended to provide the base address to be checked against. 
Shareability. Defines the shareability domain of this region for Normal memory. 
00 Non-shareable. 
[4:3] SH 01 UNPREDICTABLE. 
10 Outer shareable. 
11 Inner Shareable. 
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All other values are reserved. 


For any type of Device memory, the value of this field is ignored. 


Access permissions. 


00 Read/write by privileged code only. 
[2:1] | AP[2:1] | 01 Read/write by any privilege level. 

10 Read-only by privileged code only. 

11 Read-only by any privilege level. 


Execute Never. Defines whether code can be executed from this region. 
[0] XN 0 Execution only permitted if read permitted. 


1 Execution not permitted. 


MPU Region Base Address Register Alias, n=1-3 


The MPU_RBAR_A<n> provides indirect read and write access to the MPU base address register. Accessing 
MPU_RBAR_A<n> is equivalent to setting MPU_RNR[7:2]:n[1:0] and then accessing MPU_RBAR for the Security 
state. 


MPU Region Limit Address Register 


The MPU_RLAR defines the limit address of the MPU region selected by the MPU_RNR. 

This register is banked between Security states. 

In an implementation with the Security Extension, this register is banked between Security states. 
The MPU_RLAR bit assignments are: 


31 54 3 1 


0 
NI 





RESO 


Table 101. MPU_RLAR bit assignments 


Peis ame runcton 


Limit address. Contains bits[31:5] of the upper inclusive limit of the selected MPU memory region. 
etal ee This value is postfixed with 1F to provide the limit address to be checked against. 
[4] - Reserved, res0. 
[3:1] | Attrindx Attribute index. Associates a set of attributes in the MPU_MAIRO and MPU_MAIR‘T1 fields. 
Enable. Region enable. 
The possible values of this bit are: 


[0] EN 
0 Region disabled. 


A Region enabled. 
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4.5.16 MPU Region Limit Address Register Alias, n=1-3 


The MPU_RLAR_A<n> provides indirect read and write access to the MPU limit address register. Accessing 
MPU_RLAR_A<n> is equivalent to setting MPU_RNR[7:2]:n[1:0] and then accessing MPU_RLAR for the Security 
state 


4.5.17 MPU Memory Attribute Indirection Registers 0 and 1 


The MPU_MAIRO and MPU_MAIR‘1 provide the memory attribute encodings corresponding to the Attrindex 
values. 

These registers are banked between Security states. 

In an implementation with the Security Extension, these registers are is banked between Security states. 
The MPU_MAIRO bit assignments are: 


31 24:23 1615 87 0 





Attr3 Attr2 Attr1 AttrO 


Attr<n>, bits [8n+7:8n], for Memory attribute encoding for MPU regions with an Attrindex of n. 





n= 0 to 3. 
The MPU_MAIR?1 bit assignments are: 
31 24 23 16 15 87 0 
Attr7 Attr6 Attr5 Attr4 
Attr<n>, bits Memory attribute encoding for MPU regions with an Attrindex of n. 
[8(n-4)+7:8(n-4)], forn =4 
to 7 


MAIR_ATTR defines the memory attribute encoding used in MPU_MAIRO and MPU_MAIR71, and the bit 
assignments are: 


When MAIR_ATTRI7:4] is 0000: 


7 43210 


0000 00 





Device —! 


Table 102. MAIR_ATTR values for bits[3:2] when MAIR_ATTR[7:4] is 0000 


is] name rcton 


Device attributes. Specifies the memory attributes for Device.The possible values of this field are: 


00 Device-nGnRnE. 

[3:2] Device 01 Device-nGnRE. 
10 Device-nGRE. 
11 Device-GRE. 
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When MAIR_ATTR[7:4] is not 0000: 


7 4 3 0 


Outer Inner 


Table 103. MAIR_ATTR bit assignments when MAIR_ATTR[7:4] is not 0000 


Outer attributes. Specifies the Outer memory attributes. The possible values of this field are: 





Device memory. In this case, refer to Section 4.5.17 MPU Memory Attribute 


= Indirection Registers 0 and 1. 
OORW Normal memory, Outer write-through transient (RW is not 00). 
[7:4] Outer 0100 Normal memory, Outer non-cacheable. 
01RW Normal memory, Outer write-back transient (RW is not 00). 
10RW Normal memory, Outer write-through non-transient. 
11RW Normal memory, Outer write-back non-transient. 
R and W specify the outer read and write allocation policy: 0 = do not allocate, 1 = allocate. 
Inner attributes. Specifies the Inner memory attributes. The possible values of this field are: 
0000 UNPREDICTABLE. 
OORW Normal memory, Inner write-through transient (RW is not 00). 
0100 Normal memory, Inner non-cacheable. 
[3:0] | Inner 
01RW Normal memory, Inner write-back transient (RW is not 00). 
10RW Normal memory, Inner write-through non-transient. 
11RW Normal memory, Inner write-back non-transient. 
R and W specify the outer read and write allocation policy: 0 = do not allocate, 1 = allocate. 
4.5.18 MPU mismatch 


When access violates the MPU permissions, the processor generates a MemManage fault. 


4.5.19 Updating protected memory regions 


To update an MPU region, update the attributes in the MPU_RNR, MPU_RBAR and MPU_RLAR registers. To 
update an SAU region, update the attributes in the SAU_LRNR, SAU_RBAR and SAU_RLAR registers. 
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Updating an MPU region Simple code to configure one region: 


7 Rl = MPU region number 

7; R2 = base address, permissions and shareability 
; R3 = limit address, attributes index and enable 
LDR RO, =MPU_RNR 


STR R1, [RO, #0x0] ; MPU_RNR 
STR R2, [RO, #0x4] ; MPU_RBAR 
STR R3, [RO, #0x8] ; MPU_RLAR 


Software must use memory barrier instructions: 


. Before MPU setup if there might be outstanding memory transfers, such as buffered 
writes, that might be affected by the change in MPU settings. 


° After MPU setup if it includes memory transfers that must use the new MPU settings. 


If you want all the MPU memory access behavior to take effect immediately after the 
programming sequence, use a DSB instruction and an ISB instruction. 


Updating an SAU region Simple code to configure one region: 


7; Rl = SAU region number 

; R2 = base address 

; R3 = limit address, Non-secure callable attribute and enable 
LDR RO, =SAU_RNR 


STR R1, [RO, #0x0] ; SAU_RNR 
STR R2, [RO, #0x4] ; SAU_RBAR 
STR R3, [RO, #0x8] ; SAU_RLAR 


Software must use memory barrier instructions: 


. Before SAU setup if there might be outstanding memory transfers, such as buffered 
writes, that might be affected by the change in SAU settings. 


° After SAU setup if it includes memory transfers that must use the new SAU settings. 


If you want all the SAU memory access behavior to take effect immediately after the 
programming sequence, use a DSB instruction and an ISB instruction. 


4.5.20 MPU design hints and tips 
To update the attributes for an MPU region, update the MPU_RNR, MPU_RBAR, and MPU_RLAR registers. 


To avoid unexpected behavior, disable the interrupts before updating the attributes of a region that the interrupt 
handlers might access. When setting up the MPU, and if the MPU has previously been programmed, disable 
unused regions to prevent any previous region settings from affecting the new MPU setup. 


4.5.20.1 MPU configuration for a microcontroller 


Usually, a microcontroller system has only a single processor and no caches. 
In such a system, program the MPU as follows: 


Table 104. Memory region attributes for a microcontroller 


7 MAIR_ATTR.Outer Sh a rr - b 
emory region Ele-r-le) iii § emory type and attributes 
aes MAIR_ATTRInner a ek 


Flash memory 0b1010 Normal memory, Non-shareable, Write-Through. 
Internal SRAM 0b1010 1 Normal memory, Shareable, Write-Through. 

External SRAM 0b1111 1 Normal memory, Shareable, Write-Back, write-allocate. 
Peripherals 0b0000 - Always Shareable. 
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In most microcontroller implementations, the cache policy attributes do not affect the system behavior. However, 
using these settings for the MPU regions makes the application code more portable. The values given are for 
typical situations. In special systems, such as multiprocessor designs or designs with a separate DMA engine, the 
shareability attribute might be important. In these cases, refer to the recommendations of the memory device 
manufacturer. 


Shareability attributes define whether the global monitor is used, or only the local monitor is used. 
4.6 Floating-Point Unit 


The Cortex-M33 Floating-Point Unit (FPU) implements the FPv5 floating-point extensions. The FPU fully supports 
single-precision add, subtract, multiply, divide, multiply and accumulate, and square root operations. It also 
provides conversions between fixed-point and floating-point data formats, and floating-point constant instructions. 


The FPU provides floating-point computation functionality that is compliant with the ANSI/EEE Std 754-2008, 
IEEE Standard for Binary Floating-Point Arithmetic, referred to as the IEEE 754 standard. 


The FPU contains 32 single-precision extension registers, which you can also access as 16 doubleword registers 
for load, store, and move operations. 


Table 105. Floating-point system registers summary 


INXXe LU K=te| 
Address Description 
edanaltexe (=) 


OxEOOOEF34 FPCCR Privileged OxC0000000 | Section 4.6.1 Floating-point Context Control Register 
OxEOOOEF38 §FPCAR RW Privileged - Section 4.6.2 Floating-point Context Address Register 
- FPSCRy RW Unprivileged — - Section 4.6.3 Floating-point Status Control Register 


Section 4.6.4 Floating-point Default Status Control 


OxEOOOEF3C FPDSCR RW Privileged 0x00000000 : 
Register 


4.6.1 Floating-point Context Control Register 


The FPCCR register sets or returns FPU control data. 
This register is banked between Security states on a bit by bit basis. 
The FPCCR bit assignments are: 











































































































3130 29 28.27 2625 : 1109876543210: 
RESO s 
_TS 
“CLRONRETS 
“CLRONRET 
“_LSPENS 
“_LSPEN 
“ASPEN 
UFRDY 
SPLIMVIOL 
MONRDY ~ 
SFRDY — 
BFRDY — 
MMRDY ~ 
HFRDY — 
THREAD — 
USER~ 
LSPACT 





Table 106. FPCCR bit assignments with the Security Extension 


Peis ame uncon 


Automatic state preservation enable. Enables CONTROL.FPCA setting on execution of a floating- 
[31] ASPEN point instruction. This results in automatic hardware state preservation and restoration, for floating- 
point context, on exception entry and exit. The possible values of this bit are: 
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[30] 


[29] 


[28] 


[27] 


[26] 
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LSPEN 


LSPENS 


CLRONRET 


CLRONRETS 


TS 


Function 
0 Disable CONTROL.FPCA setting on execution of a floating-point 
instruction. 
1 Enable CONTROL.FPCA setting on execution of a floating-point 


instruction. 


This bit is banked between Security states. 


Automatic state preservation enable. Enables lazy context save of floating-point state. The possible 
values of this bit are: 


0 Disable automatic lazy context save. 


1 Enable automatic lazy state preservation for floating-point context. 


Writes to this bit from Non-secure state are ignored if LSPENS is set to one. 
This bit is not banked between Security states. 


Lazy state preservation enable Secure only. This bit controls whether the LSPEN bit is writeable from 
the Non-secure state. 


The possible values of this bit are: 


0 LSPEN is readable and writeable from both Security states. 


LSPEN is readable from both Security states. Writes to LSPEN are ignored 
4 from the Nonsecure 


state. 
Clear on return. Clear floating-point caller saved registers on exception return. 


The possible values of this bit are: 


0 Disabled. 


Enabled. 


When set to 1 the caller saved floating-point registers SO to S15, and FPSCR are cleared on 
exception return (including tail chaining) if CONTROL.FPCA is set to 1 and FRCCR_S.LSPACT is set 
to 0. 


This bit is not banked between Security states. 


Clear on return Secure only. This bit controls whether the CLRONRET bit is writeable from the Non- 
secure state. 


The possible values of this bit are: 


So 


The CLRONRET field is accessibly from both Security states. 


1 The Non-secure view of the CLRONRET field is read-only. 


This bit is RAZ/WI for a Non-secure state. 
This bit is not banked between Security states. 
Treat as Secure. Treat floating-point registers as Secure enable. 


The possible values of this bit are: 


0 Disabled. 


1 Enabled. 
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[25-11] | - 
[10] | UFRDY 
[9] SPLIMVIOL 
[8] MONRDY 
[7] SFRDY 

[6] BFRDY 
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Function 


When set to 0 the floating-point registers are treated as Non-secure even when the core is in the 
Secure state 


and, therefore, the callee saved registers are never pushed to the stack. If the floating-point registers 
never 


contain data that needs to be protected, clearing this flag can reduce interrupt latency. 
This bit is not banked between Security states. 
Reserved, res0. 


UsageFault ready. Indicates whether the software executing when the processor allocated the 
floating-point stack frame was able to set the UsageFault exception to pending. 


The possible values of this bit are: 


0 Not able to set the UsageFault exception to pending. 


1 Able to set the UsageFault exception to pending. 


This bit is banked between Security states. 


Stack pointer limit violation. This bit indicates whether the floating-point context violates the stack 
pointer limit that was active when lazy state preservation was activated. SPLIMVIOL modifies the lazy 
floating-point state preservation behavior. 


The possible values of this bit are: 


0 The existing behavior is retained. 


The memory accesses associated with the floating-point state preservation 
1 are not performed. If the floating-point is in Secure state and FPCCR.TS is 
set to 1 the registers are still zeroed and the floating-point state is lost. 


This bit is banked between Security states. 


DebugMonitor ready. Indicates whether the software executing when the processor allocated the 
floatingpoint stack frame was able to set the DebugMonitor exception to pending. 


The possible values of this bit are: 


0 Not able to set the DebugMonitor exception to pending. 


1 Able to set the DebugMonitor exception to pending. 


If DEMCR.SDME is 1 in Non-secure state this bit is RAZ/WI. 

This bit is not banked between Security states. 

SecureFault ready. 

If accessed from the Non-secure state, this bit behaves as RAZ/WI. 


If accessed from the Secure state, this bit indicates whether the software executing (when the 
processor allocated the floating-point stack frame) was able to set the SecureFault exception to 
pending. 


This bit is not banked between Security states. 


BusFault ready. Indicates whether the software executing when the processor allocated the floating- 
point stack frame was able to set the BusFault exception to pending. 


The possible values of this bit are: 


0 Not able to set the BusFault exception to pending. 


1 Able to set the BusFault exception to pending. 


If in Non-secure state and AIRCR.BFHFNMINS is zero, this bit is RAZ/WI. 
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[5] 


[4] 


[3] 


[2] 


[1] 


[0] 
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MMRDY 


HFRDY 


THREAD 


USER 


LSPACT 


This bit is not banked between Security states. 


MemManage ready. Indicates whether the software executing when the processor allocated the 
floating-point stack frame was able to set the MemManage exception to pending. 


The possible values of this bit are: 


0 Not able to set the MemManage exception to pending. 


1 Able to set the MemManage exception to pending. 


This bit is banked between Security states. 


HardFault ready. Indicates whether the software executing when the processor allocated the floating- 
point stack frame was able to set the HardFault exception to pending. 


The possible values of this bit are: 


0 Not able to set the HardFault exception to pending. 


1 Able to set the HardFault exception to pending. 
If in Non-secure state and AIRCR.BFHFNMINS is zero, this bit is RAZ/WI. 
This bit is not banked between Security states. 


Thread mode. Indicates the processor mode when it allocated the floating-point stack frame. 


The possible values of this bit are: 


0 Handler mode. 


1 Thread mode. 

This bit is for fault handler information only and does not interact with the exception model. 
This bit is banked between Security states. 

Security status of the floating point context. 

If accessed from the Non-secure state, this bit behaves as RAZ/WI. 


This bit is updated whenever lazy state preservation is activated, or when a floating-point instruction is 
executed. 


The possible values of this bit are: 


0 Indicates that the floating-point context belongs to the Non-secure state. 


1 Indicates that the floating-point context belongs to the Secure state. 


Indicates the privilege level of the software executing, when the processor allocated the floating point 
stack. 


The possible values of this bit are: 


0 Privileged level. 


1 Unprivileged level. 


This bit is banked between Security states. 
Lazy state preservation active. Indicates whether lazy preservation of the floating-point state is active. 


The possible values of this bit are: 


0 Lazy state preservation is not active. 
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A 


1 Lazy state preservation is active. 


This bit is banked between Security states. 


4.6.2 Floating-point Context Address Register 
The FPCAR register holds the location of the unpopulated floating-point register space that is allocated on an 
exception stack frame. 
This register is banked between Security states. 
The FPCAR bit assignments are: 


31 3 2 0 
ADDRESS | | 
RESO = 


Table 107. FPCAR bit assignments 


[31:3] ADDRESS | The location of the unpopulated floating-point register space that is allocated on an exception stack frame. 





[2:0] | - Reserved, resO 


4.6.3 Floating-point Status Control Register 


The FPSCR register provides all necessary User level control of the floating-point system. 
This register is not banked between Security states. 
The FPSCR bit assignments are: 


31 30 29 28:27 26 25 24 23 22 21 876543210 


N|ziclv RESO 
reso |_ RMode inc Lioc 
AHP FZ RESO DZC 
DN IXC OFC 
UFC 








Table 108. FPSCR bit assignments 





[31] N Condition code flags. Floating-point comparison operations update these flags: 
[30] 
N Negative condition code flag. 
[29] Cc 
Z Zero condition code flag. 
[28] Vv c Carry condition code flag. 
Vv Overflow condition code flag. 
[27] - Reserved, res0. 


Alternative half-precision control bit: 
[26] AHP. 
0 IEEE half-precision format selected. 
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1 Alternative half-precision format selected. 


Default NaN mode control bit: 
[25] DN 0 NaN operands propagate through to the output of a floating-point operation. 


1 Any operation involving one or more NaNs returns the Default NaN. 


Flush-to-zero mode control bit: 


Flush-to-zero mode disabled. Behavior of the floating-point system is fully 


al oi . compliant with the IEEE 754 standard. 


1 Flush-to-zero mode enabled. 


Rounding Mode control field. The encoding of this field is: 


0b00 Round to Nearest (RN) mode. 

0b01 Round towards Plus Infinity (RP) mode. 
[23:22] | RMode 

0b10 Round towards Minus Infinity (RM) mode. 

0b11 Round towards Zero (RZ) mode. 


The specified rounding mode is used by almost all floating-point instructions. 


[21:8] | - Reserved, res0. 
[7] IDC Input Denormal cumulative exception bit, see bits [4:0]. 
[6:5] - Reserved, res0. 
[4] IXC Cumulative exception bits for floating-point exceptions, see also bit[7]. Each of these bits is set to 1 to 
(3] UFC indicate that the corresponding exception has occurred since 0 was last written to it. 
[2] OFC IDC, bit[7] Input Denormal cumulative exception bit. 
[1] DZC 
IXc Inexact cumulative exception bit. 
UFC Underflow cumulative exception bit. 
[0] 10c OFC Overflow cumulative exception bit. 
DZC Division by Zero cumulative exception bit. 
10c Invalid Operation cumulative exception bit. 
4.6.4 Floating-point Default Status Control Register 


The FPDSCR register holds the default values for the floating-point status control data. The processor assigns the 
floating-point status control data to the FPSCR when it creates a new floating-point context. 


This register is banked between Security states. 
The FPDSCR bit assignments are: 
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31 27 26 25 24 23 22 21 0 


RESO 0;0;0/0 0 RESO 


AHP! |_RMode 
DN FZ 





Table 109. FPDSCR bit assignments 


A 


[31:27] - Reserved, resO 
[26] AHP Default value for FPSCR.AHP 
[25] DN Default value for FPSCR.DN 
[24] FZ Default value for FPSCR.FZ 
[23:22] RMode Default value for FRSCR.RMode 
[21:0] - Reserved, resO 
4.6.5 Code sequence for enabling the FPU 
The FPU is disabled from reset. You must enable it before you can use any floating-point instructions. The code 
sequence shows how to a enable the FPU in privileged mode. The core must be in privileged mode to read from 
and write to the CPACR. 
If the Security Extension is implemented, when the system boots up, the secure software should setup NSACR to 
determine if the FPU (coprocessor 10 and 11) is accessible from Non-secure side. The Secure software should 
also configure FPCCR to determine if the FPU is used by Secure software. After that, the FPU can be enabled. 
Enabling the FPU CPACR EQU OxE0O0ED88 
LDR RO, =CPACR ; Read CPACR 
LDR el, RO] ; Set bits 20-23 to enable CP10 and CP11 coproces 
sors 
ORR il, NIL, Gi (Oua << 210) 
STR Feil, (LISN0) | ; Write back the modified value to the CPACR 
DSB 
iS) ; Reset pipeline now the FPU is enabled. 
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Table 110. Document revision history 


a 


14-Feb-2020 A Initial release. 
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